« Volver al listado

CVE-2026-25057

Estado: AnalizadaCrítica (9.1)—

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:H sin UI:R sugiere T1210 (servicios remotos con privilegios). La falta de validación de rutas en zip permite lectura (T1005) y escritura (T1565.001) de archivos arbitrarios en disco.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork Segmentation

Tecnologías afectadas (1)

Markusproject — Markus

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25057",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25057",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-10T15:32:11.727315Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "MarkUsProject",
          "product": "Markus",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.9.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-09T20:15:56.550",
  "references": [
    {
      "url": "https://github.com/MarkUsProject/Markus/commit/0ca002a1f0071c7a00dbb2ed34fede57323c5dc7",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MarkUsProject/Markus/releases/tag/v2.9.1",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MarkUsProject/Markus/security/advisories/GHSA-mccg-p332-252h",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1."
    },
    {
      "lang": "es",
      "value": "MarkUs es una aplicación web para la entrega y calificación de trabajos de estudiantes. Antes de 2.9.1, los instructores pueden subir un archivo zip para crear una tarea a partir de una configuración exportada (courses/&lt;:course_id&gt;/assignments/upload_config_files). Los nombres de las entradas del archivo zip subido se utilizan para crear rutas para escribir archivos en el disco sin verificar estas rutas. Esta vulnerabilidad está corregida en 2.9.1."
    }
  ],
  "lastModified": "2026-06-17T10:24:03.453",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:markusproject:markus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D6B2B7B-F46C-4CEE-86D4-B25D3746747A",
              "versionEndExcluding": "2.9.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}