CVE-2026-25962: falha de média gravidade em MarkUsProject Markus
MarkUs: Zip bomb in config upload enables DoS
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.3%
MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs currently extracts zip files without any size or entry-count limits. For example, instructors can upload a zip file to provide an assignment configuration; students can upload a zip file for an assignment submission and indicate its contents should be extracted. This issue has been patched in version 2.9.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
MarkUsProject · MarkusCVEs relacionadas — MarkUsProject Markus
No mesmo produto, das mais perigosas para as menos.
CVE-2024-47820MEDIUMMarkUs vulnerable to Path TraversalEPSS 0.7%CVE-2024-51743HIGHArbitrary File Write leading up to remote code execution (instructor accounts)EPSS 0.7%CVE-2024-51499HIGHMarkUs Arbitrary File Write leading up to remote code execution (student accounts)EPSS 0.7%CVE-2026-25057CRITICALZip Slip in MarkUs config upload allowing RCEEPSS 0.5%CVE-2026-27807MEDIUMMarkUs: YAML alias (‘billion laughs’) DoS in config uploadEPSS 0.3%CVE-2026-24900MEDIUMMarkUs has a submission-view IDOR exposes all student submissionsEPSS 0.3%