MarkUsProject Markus

• CVE-2026-25962 Medium 6.5 MarkUs: Zip bomb in config upload enables DoS 0.3%
• CVE-2026-27807 Medium 4.9 MarkUs: YAML alias (‘billion laughs’) DoS in config upload 0.3%
• CVE-2026-28405 High 8.0 MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context Actions 0.3%
• CVE-2026-25057 Critical 9.1 Zip Slip in MarkUs config upload allowing RCE 0.5%
• CVE-2026-24900 Medium 6.5 MarkUs has a submission-view IDOR exposes all student submissions 0.3%
• CVE-2024-51743 High 8.8 Arbitrary File Write leading up to remote code execution (instructor accounts) 0.7%
• CVE-2024-51499 High 7.1 MarkUs Arbitrary File Write leading up to remote code execution (student accounts) 0.7%
• CVE-2024-47820 Medium 5.7 MarkUs vulnerable to Path Traversal 0.7%