This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: MarkUs < v2.9.1 has a **Path Traversal** flaw. ๐ฅ **Consequence**: Attackers can achieve **Arbitrary File Write**. This breaks integrity and availability of the system.
Q2Root Cause? (CWE/Flaw)
๐ก๏ธ **Root Cause**: **CWE-23** (Relative Path Traversal). The app fails to **validate file paths** properly before writing. ๐ซ No sanitization on user input.
Q3Who is affected? (Versions/Components)
๐ฏ **Affected**: **MarkUs** (Ruby on Rails + React). ๐ **Version**: All versions **before 2.9.1**. ๐ซ Used for student assignment submission/grading.
Q4What can hackers do? (Privileges/Data)
๐ **Impact**: **Full Control** over file system writes. ๐ Can overwrite critical config files or inject malicious scripts. ๐ **CVSS**: High (C:H, I:H, A:H).
Q5Is exploitation threshold high? (Auth/Config)
๐ **Threshold**: **Medium**. Requires **PR:H** (High Privileges). ๐ค Attacker needs valid credentials. ๐ซ Not fully open to anonymous public.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐งช **Exploit**: **No Public PoC** listed in data. ๐ต๏ธโโ๏ธ However, the flaw is logical (Path Traversal), making it **easily exploitable** by skilled hackers.
Q7How to self-check? (Features/Scanning)
๐ **Check**: Scan for **MarkUs** instances. ๐ Look for file upload/processing endpoints. ๐งช Test if relative paths (e.g., `../../`) bypass restrictions.
Q8Is it fixed officially? (Patch/Mitigation)
โ **Fixed**: Yes! **v2.9.1** is the safe version. ๐ฅ Update immediately. ๐ See GitHub Advisory GHSA-mccg-p332-252h.
Q9What if no patch? (Workaround)
๐ **No Patch?**: Implement **Input Validation** on file paths. ๐ซ Reject `..` sequences. ๐ก๏ธ Use **Chroot** or strict sandboxing for uploads.
Q10Is it urgent? (Priority Suggestion)
โก **Urgency**: **HIGH**. ๐ Published Feb 2026. ๐ Academic systems are high-value targets. ๐โโ๏ธ Patch NOW to prevent data corruption.