CVE-2026-25809 PlaciPy Code Execution Allowed Without Assessment Active State Validation
Attackers can execute code via the evaluation endpoint because the system fails to validate if the assessment is active or within its submission window.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25809?
CVE-2026-25809 is a medium-severity vulnerability in Praskla-Technology assessment-placipy, published on 9 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation endpoint does not validate the assessment lifecycle state before allowing execution. There is no check to ensure that the assessment has started, is not expired, or the submission window is currently open.
Weakness: CWE-285
Which versions are affected by CVE-2026-25809?
It affects 1 product.
Products include Prasklatechnology Placipy.
How do I fix CVE-2026-25809?
No fix has been published for CVE-2026-25809 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-25809 being exploited?
There is no known exploitation of CVE-2026-25809 in the wild and no public exploit code.
Other vulnerabilities in Praskla-Technology assessment-placipy
- CVE-2026-25812 PlaciPy is Missing CSRF Protection on State-Changing Endpoints
- CVE-2026-25814 NoSQL Injection Risk via Unsanitized Query Parameters
- CVE-2026-25875 PlaciPy Admin Privilege Escalation via Trusted JWT Claims
- CVE-2026-25753 PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)
- CVE-2026-25813 PlaciPy Exposes Sensitive Data via Application Logs
Sources
Also known as GHSA-cc32-rp29-w9x7.