Skip to content
OpenAdvisories

Vendor

MarkUsProject

8 known vulnerabilities.

Products

Markus 8
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-25962

    MarkUs: Zip bomb in config upload enables DoS

    MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs currently extracts zip files without any size or entry-count limits. For example, instructors can upload a zip file to provide an assignment conf…

    MarkUsProject Markus
  • Medium 4.9
    CVE-2026-27807

    MarkUs: YAML alias (‘billion laughs’) DoS in config upload

    MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities (e.g., assignment settings). These YAML files are parsed with al…

    MarkUsProject Markus
  • Medium 6.5
    CVE-2026-24900

    MarkUs has a submission-view IDOR exposes all student submissions

    MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content accepted a select_file_id parameter to serve SubmissionFile objects containing a …

    MarkUsProject Markus
  • Medium 5.7
    CVE-2024-47820

    MarkUs vulnerable to Path Traversal

    MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissi…

    MarkUsProject Markus