CVE-2024-47820 MarkUs vulnerable to Path Traversal
Authenticated instructors can exploit a path traversal vulnerability to read arbitrary files on the server hosting the MarkUs application.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-47820?
CVE-2024-47820 is a medium-severity path traversal vulnerability in MarkUsProject Markus, published on 18 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. MarkUs v2.4.8 has addressed this issue. No known workarounds are available at the application level aside from upgrading.
Weakness: CWE-22
Which versions are affected by CVE-2024-47820?
It affects 1 product.
Products include Markusproject Markus.
How do I fix CVE-2024-47820?
No fix has been published for CVE-2024-47820 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-47820 being exploited?
There is no known exploitation of CVE-2024-47820 in the wild and no public exploit code.
Other vulnerabilities in MarkUsProject Markus
- CVE-2026-25057 Zip Slip in MarkUs config upload allowing RCE
- CVE-2026-28405 MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context Actions
- CVE-2024-51499 MarkUs Arbitrary File Write leading up to remote code execution (student accounts)
- CVE-2024-51743 Arbitrary File Write leading up to remote code execution (instructor accounts)
- CVE-2026-25962 MarkUs: Zip bomb in config upload enables DoS
Sources
Also known as GHSA-wq6v-vx8c-8fj8.