{"id":"CVE-2026-24479","aliases":["EUVD-2026-4836","GHSA-xmgg-2rw4-7fxj"],"status":"published","title":"HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE","description":"HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.08133,"percentile":0.94921,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2026-01-27T00:43:42Z","modified":"2026-11-11T10:30:31Z","exploits":[{"source":"metasploit","id":"exploit/linux/http/hustoj_problem_import_rce","title":"HUSTOJ Admin users can zip-slip problem_import_qduoj.php, planting PHP files in webroot for RCE","type":"exploit","platform":"Linux","date":"2026-01-26","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/hustoj_problem_import_rce"},{"source":"exploitdb","id":"EDB-52539","title":"HUSTOJ Zip-Slip v26.01.24 -  RCE","type":"webapps","platform":"multiple","date":"2026-04-30","url":"https://www.exploit-db.com/exploits/52539"}],"products":[{"vendor":"hustoj","product":"hustoj"},{"vendor":"zhblue","product":"hustoj"}],"references":[{"url":"https://github.com/zhblue/hustoj/security/advisories/GHSA-xmgg-2rw4-7fxj","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory"]},{"url":"https://github.com/zhblue/hustoj/commit/902bd09e6d0011fe89cd84d4236899314b33101f","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24479.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24479","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-24479","title":"HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE","description":"HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.","status":"published","published":"2026-01-27T00:43:42.799Z","modified":"2026-01-27T14:42:04.04Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:50.575061Z"}],"euvd":[{"id":"EUVD-2026-4836","description":"HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.","status":"published","published":"2026-01-27T00:43:42Z","modified":"2026-01-27T14:42:04Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T19:48:47.293439Z"}],"nvd":[{"id":"CVE-2026-24479","description":"HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.","status":"published","published":"2026-01-27T01:16:02.017Z","modified":"2026-06-17T10:23:07.917Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"CVE-2026-24479","title":"HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE","description":"HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.","status":"published","published":"2026-01-27T00:43:42.799Z","modified":"2026-11-11T10:30:31.898821189Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-11T11:06:42.68927Z"}]}}