CVE-2026-24900: medium-severity vulnerability in MarkUsProject Markus
MarkUs has a submission-view IDOR exposes all student submissions
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.3%
MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content accepted a select_file_id parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correctly scoped to the requesting user, allowing users access arbitrary submission file contents by id. This vulnerability is fixed in 2.9.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
MarkUsProject · MarkusRelated CVEs — MarkUsProject Markus
In the same product, most dangerous first.
CVE-2024-47820MEDIUMMarkUs vulnerable to Path TraversalEPSS 0.7%CVE-2024-51743HIGHArbitrary File Write leading up to remote code execution (instructor accounts)EPSS 0.7%CVE-2024-51499HIGHMarkUs Arbitrary File Write leading up to remote code execution (student accounts)EPSS 0.7%CVE-2026-25057CRITICALZip Slip in MarkUs config upload allowing RCEEPSS 0.5%CVE-2026-27807MEDIUMMarkUs: YAML alias (‘billion laughs’) DoS in config uploadEPSS 0.3%CVE-2026-25962MEDIUMMarkUs: Zip bomb in config upload enables DoSEPSS 0.3%