What is the CVSS score of CVE-2026-25057?

CVE-2026-25057 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Markus are affected by CVE-2026-25057?

A critical vulnerability in MarkUs allows instructors to upload malicious zip files through the assignment configuration upload feature, potentially enabling arbitrary code execution and unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-25057?

Within 24 hours: Identify all MarkUs instances and their versions; restrict access to the course assignment upload feature to system administrators only. Within 7 days: Apply the 2.9.1 patch to all affected MarkUs installations and conduct a thorough audit of uploaded assignment files for indicators of compromise. Within 30 days: Complete post-incident review, implement file upload validation controls, and update instructor security training on file handling procedures.

Markus CVE-2026-25057

CRITICAL

Relative Path Traversal (CWE-23)

2026-02-09 security-advisories@github.com

Path Traversal Markus

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 19, 2026 - 20:25 nvd

Patch available

CVE Published

Feb 09, 2026 - 20:15 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1.

AnalysisAI

MarkUs grading platform prior to 2.9.1 has a path traversal enabling students to access other students' submissions or grading data.

Technical ContextAI

MarkUs < 2.9.1 has a CWE-23 relative path traversal that allows users to access files outside their intended scope, potentially reading other students' submissions or instructor grading data.