Skip to main content

PHP CVE-2026-24479

CRITICAL
Path Traversal (CWE-22)
2026-01-27 security-advisories@github.com
9.8
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
Patch released
Mar 02, 2026 - 21:32 nvd
Patch available
CVE Published
Jan 27, 2026 - 01:16 nvd
CRITICAL 9.8

DescriptionGitHub Advisory

HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.

AnalysisAI

HUSTOJ online judge has a path traversal vulnerability enabling arbitrary file access on the competition server.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious ZIP with path traversal filenames
Delivery
Upload via problem_import_qduoj.php or problem_import_hoj.php
Exploit
Extract to arbitrary web root locations
Execution
Write PHP shell to accessible directory
Impact
Execute arbitrary code

Vulnerability AssessmentAI

Exploitation No special conditions — remote unauthenticated exploitation against HUSTOF versions prior to 26.01.24 with problem import functionality enabled on publicly accessible endpoints. Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 9.8 with patch. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker uses path traversal to read test cases, steal other participants' solutions, or access server configuration.
Remediation Update HUSTOJ. Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Disable problem_import_qduoj.php and problem_import_hoj.php modules or restrict access to trusted administrators only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-24479 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy