HUSTOJ, an open‑source online judge, contains an arbitrary file write flaw caused by Zip Slip in the problem_import_qduoj.php and problem_import_hoj.php modules. Attackers can craft a ZIP archive with path traversal entries (e.g., ../../shell.php). When the server extracts the archive, it writes files to arbitrary locations within the web root, allowing the execution of attacker‑supplied code and full compromise of the host. This vulnerability is a classic path‑traversal weakness as identified by CWE‑22.

The issue affects all installations of HUSTOJ from versions prior to 26.01.24. The vendor implemented a fix in release 26.01.24, which removes the failure to sanitize filenames in ZIP uploads. Users running older versions are vulnerable until they upgrade.

The CVSS score of 9.3 indicates a critical severity. While the EPSS score is less than 1 %, implying a low current exploitation probability, the resulting remote code execution outage warrants high vigilance. The attack vector is remote: an adversary uploads a malicious ZIP file to the import modules, triggering the path traversal during extraction. The lack of a KEV listing does not diminish the risk; the vulnerability remains actionable and should be patched promptly.