CVE-2026-24479 HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE
Attackers can achieve remote code execution by uploading a malicious ZIP archive with path traversal sequences in HUSTOJ problem import modules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-24479?
CVE-2026-24479 is a critical path traversal vulnerability in zhblue hustoj, published on 27 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.
Weakness: CWE-22
Which versions are affected by CVE-2026-24479?
It affects 1 product.
Products include Hustoj Hustoj.
How do I fix CVE-2026-24479?
No fix has been published for CVE-2026-24479 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-24479 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24479 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in zhblue hustoj
Sources
Also known as GHSA-xmgg-2rw4-7fxj.