Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck
CVE-2026-85684marker through 2.0.0 Path Traversal via upload filename
Critical 9.1
In plain English
A critical-severity security flaw in marker from datalab-to. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.1%top 34.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| datalab-to | marker | 0 – through 2.0.0 |
Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
References
- GitHub Issue #1047 issue-tracking
- https://github.com/datalab-to/marker product
- https://github.com/datalab-to/marker/blob/v2.0.0/marker/scripts/server.py technical-description
- VulnCheck Advisory: marker through 2.0.0 Path Traversal via upload filename third-party-advisory