CVE-2026-24479 CRITICAL

CVE-2026-24479: HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE

Vendor Zhblue

Product hustoj

Weakness CWE-22 · Path traversal

Published January 27, 2026

Last update January 27, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.

Key dates

02Disclosure timeline

January 27, 2026 CVE published

January 27, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-24479 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html