CVE-2026-25962

Description

MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs currently extracts zip files without any size or entry-count limits. For example, instructors can upload a zip file to provide an assignment configuration; students can upload a zip file for an assignment submission and indicate its contents should be extracted. This issue has been patched in version 2.9.4.

PUBLISHED Reserved 2026-02-09 | Published 2026-03-06 | Updated 2026-03-06 | Assigner GitHub_M

Problem types

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

Product status

References

github.com/...Markus/security/advisories/GHSA-x8xv-j7fc-65x5

github.com/MarkUsProject/Markus/releases/tag/v2.9.4

cve.org (CVE-2026-25962)

nvd.nist.gov (CVE-2026-25962)

Download JSON