by Kastro
Paper/Archive/CVE-2026-85684

CVE-2026-85684

datalab-to marker — marker through 2.0.0 Path Traversal via upload filename

EPSS 1%public exploitCVSS 9.1
critical.is priorityof 100
51
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 65.8.658 × 2013.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.

Affected

ProductAffectedFixed inSource
marker≤ 2.0.0–CNA

Scores by source

VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
VulnCheck (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitgithub.com/datalab-to/marker/issues/1047refgithub.com/datalab-to/markerwriteupgithub.com/datalab-to/marker/blob/v2.0.0/marker/scripts/server.pywriteupvulncheck.com/advisories/marker-through-2.0.0-path-traversal-via-upload-filename