Description

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-04T15:17:46.077Z",
  "pubdate": "2026-09-04T15:17:46.077Z",
  "executiveSummary": "The marker library up to version 2.0.0 is susceptible to a critical path traversal vulnerability within its FastAPI /marker/upload handler. This security flaw originates from the improper sanitization of the file.filename parameter during the file upload process.\nBy submitting malicious filenames containing directory traversal sequences (e.g., ../), an unauthenticated attacker can escape the intended destination directory. This allows for arbitrary file write operations or the deletion of existing files on the host filesystem.\nThe vulnerability poses a severe risk to system integrity and availability. An attacker can overwrite sensitive configuration files, modify application code, or delete critical system binaries, potentially leading to full system compromise, remote code execution (RCE), or denial-of-service conditions.\nExploitation does not require prior authentication or elevated privileges, significantly increasing the attack surface for exposed services utilizing the /marker/upload endpoint.",
  "technicalDetails": "The vulnerability is classified as a Path Traversal issue stemming from the insecure handling of user-supplied input used in file system operations. Specifically, the FastAPI /marker/upload handler accepts a filename provided by the client via the file.filename attribute without applying sufficient validation or normalization routines.\nIn the underlying implementation, the application likely joins the user-provided filename directly to a base directory path before passing it to an I/O operation. Because the library fails to strip or neutralize directory traversal sequences such as '../', the application treats the entire string as a relative path from the intended upload directory.\nThe attack flow proceeds as follows: An attacker sends a specially crafted POST request to the /marker/upload endpoint. The multipart form-data payload includes a file part where the 'filename' parameter is set to a malicious string, such as '../../../../etc/passwd' or similar, depending on the application's base path and permissions. When the handler processes this metadata, the path resolution mechanism interprets the traversal sequences, effectively breaking out of the designated upload directory.\nSuccessful exploitation results in arbitrary file I/O. If the application process is running with sufficient privileges, an attacker can overwrite critical system files or overwrite application-critical scripts to achieve secondary payloads. Furthermore, the logic may allow an attacker to delete existing files by providing a malicious filename that targets specific system or application resources, potentially disrupting service availability.\nThe affected versions include all releases of marker up to and including version 2.0.0. The vulnerability is externally accessible via the network, and because it does not require authentication, the attack vector is categorized as high in exploitability. The lack of input sanitization acts as the primary root cause, as the application assumes the 'filename' parameter provided by the client is a trusted, simple file name rather than an untrusted, malicious input vector."
}