Critical · published February 9, 2026
🚨 A crafty zip file can lead to serious file mishaps in MarkUs versions before 2.9.1! What if your instructor's uploaded assignment file could create paths to write files anywhere on your server? 🔥 Think of it like a delivery service that accepts any address on the package without checking if it’s legit — suddenly, your private files might end up in a public space, and that’s not what we want! 📦 An attacker could exploit this vulnerability to write files anywhere on the server, potentially exposing sensitive data or compromising the entire application. Imagine a scenario where a mischievous student sneaks in a file that alters grades or steals confidential information — it’s an absolute nightmare waiting to happen!
Think of it like a delivery service that accepts any address on the package without checking if it’s legit — suddenly, your private files might end up in a public space, and that’s not what we want! 📦 This flaw arises because MarkUs allows instructors to upload zip files that are processed without validating the entry names, leading to unrestricted file path creation on the server.
An attacker could exploit this vulnerability to write files anywhere on the server, potentially exposing sensitive data or compromising the entire application. Imagine a scenario where a mischievous student sneaks in a file that alters grades or steals confidential information — it’s an absolute nightmare waiting to happen! To protect your system, upgrade MarkUs immediately to version 2.9.1 or later. Review any uploaded assignments and ensure that file path validation is implemented in future configurations. Don't let this one slip through the cracks! You've got this! Follow these steps and bolster your defenses now. 🛡️