What is the CVSS score of CVE-2026-24479?

CVE-2026-24479 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of PHP are affected by CVE-2026-24479?

HUSTOF online judge systems are vulnerable to critical remote code execution through malicious ZIP file uploads in problem import modules.. A patch is available.

Is there a public PoC exploit available for CVE-2026-24479?

Yes, a public proof-of-concept exploit is available for CVE-2026-24479. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2026-24479?

Within 24 hours: Disable problem_import_qduoj.php and problem_import_hoj.php modules or restrict access to trusted administrators only. Within 7 days: Apply vendor patch to version 26.01.24 or later and test in staging environment. Within 30 days: Conduct security audit of uploaded problem sets, review access logs for suspicious import activity, and implement file upload validation controls.

PHP CVE-2026-24479

CRITICAL

Path Traversal (CWE-22)

2026-01-27 security-advisories@github.com

Linux PHP MySQL RCE Path Traversal Hustoj

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 02, 2026 - 21:32 nvd

Patch available

CVE Published

Jan 27, 2026 - 01:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.