CVE-2026-25057

MarkUs is a web application for grading student assignments.

Summary

MarkUs assignment configuration ZIP uploads are vulnerable to path traversal (Zip Slip), allowing arbitrary file writes and enabling remote code execution.

Details

Archive entry names are used to construct filesystem paths without checking that the resulting paths remain within the intended extraction directory. An authenticated instructor can upload a crafted archive containing traversal sequences to write files outside that directory.

The impact depends on the application process's filesystem permissions. Overwriting executable application files can lead to remote code execution.

Reproduction

1. Generate zip-slip-check.zip with the required fixtures using poc.py.

2. Log in to MarkUs as an instructor, navigate to any course's Assignments page, click "Upload the configuration zip file" and submit the archive.

3. Start a listener in the environment reachable by the payload's callback address:

   root@kitploit:~

   nc -lvnp 8080 -vvv
   

4. As a student, add your public SSH key to your MarkUs profile, then trigger a Git over SSH operation against any course repository.

   root@kitploit:~

   git clone ssh://markus@<host>:2222/~/csc123