MarkUsProject's Markus is a web application designed to facilitate submission and grading of student assignments. Versions prior to 2.9.1 contain a critical security flaw classified as CWE-23: Relative Path Traversal. This vulnerability arises from insecure handling of zip file uploads by instructors when creating assignments from exported configurations. Specifically, the application does not properly validate or sanitize the entry names within the uploaded zip archive, allowing path traversal sequences (e.g., '../') to manipulate file paths. Consequently, an authenticated instructor with the ability to upload zip files can craft archive entries that write files outside the intended directory structure on the server's filesystem. This can lead to overwriting critical files, uploading malicious scripts, or modifying configuration files, resulting in full compromise of confidentiality, integrity, and availability (CIA triad). The CVSS v3.1 score of 9.1 reflects the high severity, with network attack vector, low attack complexity, required high privileges, no user interaction, and scope change. The vulnerability was publicly disclosed on February 9, 2026, and fixed in Markus version 2.9.1. No known exploits have been reported in the wild yet, but the potential impact is severe given the nature of the flaw and the privileged access required to exploit it.

For European organizations, particularly educational institutions using Markus for assignment management, this vulnerability poses a significant risk. Exploitation could allow attackers to overwrite or create arbitrary files on the server, potentially leading to unauthorized code execution, data theft, or denial of service. This threatens sensitive student data confidentiality and the integrity of grading processes. The availability of the service could also be disrupted, impacting academic operations. Given the critical CVSS score and the ability to escalate impact beyond the initially affected component (scope change), organizations face risks of widespread compromise within their infrastructure if Markus servers are connected to broader networks. The requirement for authenticated high-privilege users limits exposure but insider threats or compromised instructor accounts could be leveraged. The lack of known exploits in the wild suggests a window for proactive mitigation before active attacks emerge.

European organizations should immediately upgrade all Markus instances to version 2.9.1 or later, where the vulnerability is patched. Until upgrades are complete, implement strict access controls to limit instructor upload permissions and monitor for unusual file upload activity. Employ network segmentation to isolate Markus servers from critical infrastructure. Validate and sanitize all uploaded zip file contents at the application or proxy level to detect and block path traversal sequences. Conduct regular audits of file system integrity on Markus servers to detect unauthorized changes. Educate instructors and administrators about the risks of compromised credentials and enforce strong authentication mechanisms, including multi-factor authentication. Maintain up-to-date backups of critical data to enable recovery in case of compromise. Finally, monitor threat intelligence sources for emerging exploit reports related to CVE-2026-25057.