CVE-2026-85684 marker through 2.0.0 Path Traversal via upload filename
Unauthenticated attackers can exploit path traversal in the upload handler to write or delete arbitrary files, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85684?
CVE-2026-85684 is a high-severity path traversal vulnerability in datalab-to marker, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.
Weakness: CWE-73
Which versions are affected by CVE-2026-85684?
How do I fix CVE-2026-85684?
No fix has been published for CVE-2026-85684 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-85684 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85684 exists.
Sources
Also known as GHSA-g3jg-rghx-7246.