CVE-2026-85684 Details
Description
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.
A path traversal vulnerability has been identified in the Marker application, specifically in versions through 2.0.0. The issue resides within the FastAPI upload handler, which fails to properly sanitize the 'file.filename' parameter. This vulnerability allows unauthenticated attackers to manipulate filenames with directory traversal sequences, enabling them to write arbitrary files to any location on the system or delete existing files.
To address this vulnerability, implement filename sanitization to remove directory traversal sequences and ensure that the resolved path remains within the upload directory. Additionally, consider requiring authentication for the upload endpoint.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/datalab-to/marker/issues/1047 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/datalab-to/marker | [email protected] | ProductSource CodeVendor |
| https://github.com/datalab-to/marker/blob/v2.0.0/marker/scripts/server.py | [email protected] | Source CodeVendor |
| https://github.com/datalab-to/marker/issues/1047 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/marker-through-2.0.0-path-traversal-via-upload-filename | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| datalab-to marker | <= 2.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |