EUVD-2026-71133
GHSA-g3jg-rghx-7246
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint writes or deletes arbitrary files; no confidentiality impact; integrity and availability both high.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.
AnalysisAI
Arbitrary file write and deletion in datalab-to/marker through v2.0.0 exposes servers to full filesystem compromise via the FastAPI /marker/upload handler. Unauthenticated remote attackers can supply directory traversal sequences in the file.filename parameter - unsanitized before use in path construction - to write attacker-controlled content to or delete files at any location reachable by the server process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The marker FastAPI server must be running with the `/marker/upload` endpoint network-accessible to the attacker - confirmed unauthenticated by the PR:N CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VI:H/VA:H) accurately reflects a worst-case posture: fully remote, zero-authentication, low-complexity exploitation against any network-reachable instance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version has been confirmed in the available data; the issue is tracked in GitHub issue #1047 at https://github.com/datalab-to/marker/issues/1047, and operators should monitor the upstream repository at https://github.com/datalab-to/marker for a patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all Marker deployments at v2.0.0 or earlier, verify internet exposure, and immediately isolate or disable the /marker/upload endpoint for any public-facing instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today