What’s Vulnerable › Vulnerabilities

CVE-2026-24479: HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-27 · updated 2026-06-17
• Weakness: CWE-22

Description

HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.

Affected products

• zhblue hustoj: before 26.01.24 — fixed in 26.01.24

How to fix

Upgrade to a fixed version: zhblue hustoj 26.01.24. Check the vendor advisory for mitigations.

References

• https://github.com/zhblue/hustoj/commit/902bd09e6d0011fe89cd84d4236899314b33101f
• https://github.com/zhblue/hustoj/security/advisories/GHSA-xmgg-2rw4-7fxj

Get alerted when CVE-2026-24479 or the next vulnerability affects your stack