Marker
Monthly
Arbitrary file write and deletion in datalab-to/marker through v2.0.0 exposes servers to full filesystem compromise via the FastAPI /marker/upload handler. Unauthenticated remote attackers can supply directory traversal sequences in the `file.filename` parameter - unsanitized before use in path construction - to write attacker-controlled content to or delete files at any location reachable by the server process. No public exploit code has been confirmed at time of analysis, but the VulnCheck advisory and GitHub issue #1047 reference the vulnerable code path in `marker/scripts/server.py`, making independent reproduction straightforward.
Arbitrary file write and deletion in datalab-to/marker through v2.0.0 exposes servers to full filesystem compromise via the FastAPI /marker/upload handler. Unauthenticated remote attackers can supply directory traversal sequences in the `file.filename` parameter - unsanitized before use in path construction - to write attacker-controlled content to or delete files at any location reachable by the server process. No public exploit code has been confirmed at time of analysis, but the VulnCheck advisory and GitHub issue #1047 reference the vulnerable code path in `marker/scripts/server.py`, making independent reproduction straightforward.