ustr/cve-2026-25057PoC for Zip Slip in MarkUs Assignment Configuration Uploads
MarkUs is a web application for grading student assignments.
MarkUs assignment configuration ZIP uploads are vulnerable to path traversal (Zip Slip), allowing arbitrary file write and enabling remote code execution.
Archive entry names are used to construct filesystem paths without checking that the resulting paths remain within the intended extraction directory. An authenticated instructor can upload a crafted archive containing traversal sequences to write files outside that directory.
The impact depends on the application process's filesystem permissions. Overwriting executable application files can lead to remote code execution.
Generate zip-slip-check.zip with the required fixtures using poc.py.
Log in to MarkUs as an instructor, navigate to any course's Assignments page, click "Upload the configuration zip file" and submit the archive.
Start a listener in the environment reachable by the payload's callback address:
nc -lvnp 8080 -vvv
As a student, add your public SSH key to your MarkUs profile, then trigger a Git over SSH operation against any course repository.
git clone ssh://markus@<host>:2222/~/csc123
MarkUs <= 2.9.0.
Fixed in version 2.9.1.
Upgrade to a supported MarkUs release containing the fix. Restricting the application process's filesystem permissions can limit the impact.
https://github.com/MarkUsProject/Markus/security/advisories/GHSA-mccg-p332-252h