« Volver al listado

CVE-2026-25962

Estado: AnalizadaMedia (6.5)—

MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs currently extracts zip files without any size or entry-count limits. For example, instructors can upload a zip file to provide an assignment configuration; students can upload a zip file for an assignment submission and indicate its contents should be extracted. This issue has been patched in version 2.9.4.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Markusproject — Markus

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25962",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25962",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-06T15:50:47.797017Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "MarkUsProject",
          "product": "Markus",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.9.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-06T04:16:07.620",
  "references": [
    {
      "url": "https://github.com/MarkUsProject/Markus/releases/tag/v2.9.4",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/MarkUsProject/Markus/security/advisories/GHSA-x8xv-j7fc-65x5",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-409"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs currently extracts zip files without any size or entry-count limits. For example, instructors can upload a zip file to provide an assignment configuration; students can upload a zip file for an assignment submission and indicate its contents should be extracted. This issue has been patched in version 2.9.4."
    },
    {
      "lang": "es",
      "value": "MarkUs es una aplicación web para la entrega y calificación de tareas de estudiantes. Antes de la versión 2.9.4, MarkUs actualmente extrae archivos zip sin límites de tamaño o de número de entradas. Por ejemplo, los instructores pueden subir un archivo zip para proporcionar una configuración de tarea; los estudiantes pueden subir un archivo zip para la entrega de una tarea e indicar que su contenido debe ser extraído. Este problema ha sido parcheado en la versión 2.9.4."
    }
  ],
  "lastModified": "2026-06-17T10:25:30.043",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:markusproject:markus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68B46CED-C806-4F2A-B1C6-727EE540E7A2",
              "versionEndExcluding": "2.9.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}