The vulnerability arises from the lack of path validation when extracting a ZIP file uploaded through the assignment configuration import. An attacker who can supply a crafted ZIP file can create filenames containing directory traversal characters, causing the server to write files to arbitrary locations on the filesystem. If the attacker can place an executable or overwrite configuration files, this results in remote code execution or further compromise of the MarkUs instance. The weakness is a classic path traversal flaw (CWE‑23).

MarkUs Project MarkUs is affected. All releases before version 2.9.1 contain the flaw. The upload configuration endpoint (courses/<:course_id>/assignments/upload_config_files) is vulnerable. The issue has been fixed in release 2.9.1. No other MarkUs versions are mentioned as affected.

CVSS score of 9.1 signals a critical vulnerability. However, the EPSS score of less than 1% indicates that the probability of exploitation in the wild is low at present, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector requires authenticated access as an instructor or a role with permission to upload assignment configurations. Once the attacker provides a malicious ZIP file, the unchecked paths allow arbitrary file creation, which an attacker can use to deliver or execute code on the server. The vulnerability is mitigated by upgrading to version 2.9.1, which includes proper path validation.