CVE-2026-24479

CRITICAL EPSS 94.0%
Published Jan 27, 20265mo ago · Modified Jun 17, 20262w ago
9.3 CVSS 4.0
Critical
Find Similar
Published Jan 27, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago

Description

HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.

CVSS Details

Base Score
9.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
94.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
hustojhustoj* <26.01.24

References 2

  • github.com https://github.com/zhblue/hustoj/commit/902bd09e6d0011fe89cd84d4236899314b33101f
    Patch
  • github.com https://github.com/zhblue/hustoj/security/advisories/GHSA-xmgg-2rw4-7fxj
    Vendor Advisory

Remediation

  • github.com https://github.com/zhblue/hustoj/commit/902bd09e6d0011fe89cd84d4236899314b33101f
    Patch