https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T11:13:17.641007+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-25057 CVE-2026-25057 — Zip Slip in MarkUs config upload allowing RCE 2026-10-08T11:13:17.661292+00:00

Affected: MarkUsProject Markus

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The uploaded zip file entry names are used to create paths to write files to disk without checking these paths. This vulnerability is fixed in 2.9.1.