CVE-2026-27807

EUVD-2026-9968
MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities (e.g., assignment settings). These YAML files are parsed with aliases enabled. This issue has been patched in version 2.9.4.
XML Entity Expansion
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.9 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
markusprojectmarkus
𝑥
< 2.9.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/MarkUsProject/Markus/releases/tag/v2.9.4
https://github.com/MarkUsProject/Markus/security/advisories/GHSA-m9rx-85mx-q9h6