{"id":"CVE-2026-24479","summary":"HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE","details":"HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.","aliases":["GHSA-xmgg-2rw4-7fxj"],"modified":"2026-08-12T03:51:16.573721913Z","published":"2026-01-27T00:43:42.799Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24479.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-22"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24479.json"},{"type":"ADVISORY","url":"https://github.com/zhblue/hustoj/security/advisories/GHSA-xmgg-2rw4-7fxj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24479"},{"type":"FIX","url":"https://github.com/zhblue/hustoj/commit/902bd09e6d0011fe89cd84d4236899314b33101f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zhblue/hustoj","events":[{"introduced":"0"},{"fixed":"931006358a3b26cb179260e8d98aafa7179bcc67"},{"fixed":"902bd09e6d0011fe89cd84d4236899314b33101f"}],"database_specific":{"cpe":"cpe:2.3:a:hustoj:hustoj:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"26.01.24"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["26.01.01","25.12.10","25.12.01","25.10.20","25.05.29","25.05.15","25.01.31","24.12.25","24.12.22","24.12.13","24.10.19","24.10.07","24.09.30","24.09.29","24.09.21","24.09.19","24.09.17","24.09.10","24.08.26","24.08.11","24.07.11","24.06.11","24.05.24","24.03.26","24.03.18","24.03.01","24.02.25","23.02.08","24.01.30","23.12.25","23.12.10","23.12.02","23.11.07","23.08.30","23.04.19","23.01.21","23.01.10","22.12.25","22.12.22","22.12.19","22.12.14","22.11.19","22.11.09","22.11.04","22.10.28","22.10.21","22.10.11","20221011","22.09.22","22.09.13","22.08.30","22.08.14-preRTJ","22.08.08","22.07.18","22.07.11","22.06.21","22.06.06","22.05.19","22.05.11","RTX3090Ti","22.03.25","22.03.17","22.02.23","22.02.01","22.01.13","22.01.01","21.12.25","21.10.26","21.10.13","21.10.01","21.09.21","21.08.24","21.08.18","21.08.16","2021.08.12","21.08.10","21.06.26","21.06.23","21.06.07","21.05.29","21.05.24","21.05.12","21.05.05","21.05.03","21.05.01","21.04.26","21.04.12","21.04.05","21.03.08","21.02.09","21.02.06","21.02.02","21.01.07","21.01.01","20.12.29","20.12.28","20.12.18","20.12.13","20.11.30","20.11.21","20.10.26","20.10.20","20.10.11","20.09.25","20.09.23","20.09.18","20200901","20.08.18","20.08.14","20.08.08","20.07.27","20200725","20.07.12","20.06.27","20.05.28","20.05.15","20.04.22","20.04.10","20.01.27","20.01.25","20.01.23","20.01.22","20.01.20","20.01.11","20.01.03","19.12.31","19.12.26","19.12.21","19.12.20","19.12.16","19.12.13","19.12.08","19.12.05","19.12.01","19.11.20","CCPC2019","19.11.03","19.11.13-3","19.11.13-2","19.11.13","19.11.12","19.11.09","19.11.06","19.10.27","19.10.19","19.10.15","19.10.10","19.10.07","19.10.06","19.10.03","19.10.01","19.09.23","19.08.23","19.09.19","19.09.17.2223","19.09.17","19.08.28","19.08.26","19.08.07","19.08.06","19.08.01","19.04.30","19.07.18","19.07.17","19.07.15","19.07.13","19.07.12","19.07.06.02","19.07.06","19.07.03","19.07.01","19.06.24","19.06.21","19.06.18","19.06.13","19.06.12","19.06.10","19.06.09","19.06.08-Fortran","19.06.08","19.06.04","19.06.01","19.05.27","19.05.25","19.05.19","19.05.18","19.05.17","19.05.16.test3","19.05.16-test2","19.05.16-test","19.05.16","19.05.15","19.05.14","19.05.13","19.05.07","19.04.21","19.03.27","19.01.21","19.01.01","20181229","18.12.22","18.12.08","18.11.06","18.10.29","18.10.24","18.10.21","18.10.03","18.09.26","18.09.17","18.08.25","18.08.14","18.08.13","18.08.02","18.07.17","18.07.13","18.06.16","18.06.04","18.05.23","18.4.30","18.4.25","18.4.18","18.04.03","18.03.25","18.03.19","18.03.15","18.02.20","18.02.09","18.02.05","20180101","17.12.29-2","17.12.29","2017-Christmas","17.12.23","17.10.08","100judges","php7-pdo","17.06.01","17.05.30","17.05.10","17.02.08","17.01.31","17.01.30","17.01","16.12.02","16.12.01","16.11.04","16.11.03","16.11.02","16.11","16.08.10","16.07.1","16.05.5","16.05.3","16.05.2","16.05","15.12","rc20151123"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24479.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}