CVE-2026-25057
📋 TL;DR
This vulnerability allows instructors to achieve arbitrary file write on the server by uploading specially crafted zip files. Attackers could write malicious files anywhere the application has write permissions, potentially leading to remote code execution. All MarkUs instances running versions before 2.9.1 are affected.
💻 Affected Systems
- MarkUs
📦 What is this software?
Markus by Markusproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Arbitrary file write allowing attackers to modify application files, create backdoors, or overwrite critical system files.
If Mitigated
Limited impact if file permissions are properly restricted and monitoring detects unusual file writes.
🎯 Exploit Status
Exploitation requires instructor credentials but is technically simple once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.1
Vendor Advisory: https://github.com/MarkUsProject/Markus/security/advisories/GHSA-mccg-p332-252h
Restart Required: Yes
Instructions:
1. Backup your current MarkUs installation and database. 2. Update to MarkUs version 2.9.1 or later. 3. Restart the MarkUs application server. 4. Verify the fix by checking the version.
🔧 Temporary Workarounds
Disable assignment configuration upload
allTemporarily disable the vulnerable endpoint until patching is possible
# Modify web server configuration to block access to /courses/*/assignments/upload_config_files
# Example for nginx: location ~ ^/courses/.*/assignments/upload_config_files$ { return 403; }
Restrict instructor account access
allTemporarily disable or restrict instructor accounts that don't need assignment creation capabilities
# Review and disable unnecessary instructor accounts in MarkUs admin interface
🧯 If You Can't Patch
- Implement strict file permission controls to limit where MarkUs can write files
- Deploy file integrity monitoring to detect unauthorized file writes in sensitive directories
🔍 How to Verify
Check if Vulnerable:
Check if MarkUs version is below 2.9.1. Review application logs for suspicious file uploads to the upload_config_files endpoint.Check Version:
Check MarkUs version in admin interface or application configuration filesVerify Fix Applied:
Confirm MarkUs version is 2.9.1 or higher. Test that path traversal attempts in zip file names are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside expected directories
- Multiple failed upload attempts with suspicious filenames
- Access to upload_config_files endpoint with zip files containing path traversal sequences
Network Indicators:
- Large or unusual zip file uploads to the vulnerable endpoint
- POST requests to /courses/*/assignments/upload_config_files
SIEM Query:
source="markus_logs" AND (uri_path="/courses/*/assignments/upload_config_files" OR file_write_path CONTAINS "../")