CVE-2026-27807: Markusproject Markus XXE Vulnerability

CVE-2026-27807 Overview

CVE-2026-27807 is a Denial of Service vulnerability in MarkUs, a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create or update various entities such as assignment settings. These YAML files are parsed with aliases enabled, making the application susceptible to YAML alias expansion attacks (CWE-776: Improper Restriction of Recursive Entity References in DTDs).

Critical Impact

Authenticated instructors can upload maliciously crafted YAML files that exploit recursive alias expansion to cause resource exhaustion and denial of service, potentially disrupting academic operations and grading activities.

Affected Products

• MarkUsProject MarkUs versions prior to 2.9.4

Discovery Timeline

• March 6, 2026 - CVE-2026-27807 published to NVD
• March 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-27807

Vulnerability Analysis

This vulnerability stems from improper handling of YAML alias expansion in MarkUs's file upload functionality. YAML aliases allow users to define anchors and references within YAML documents, which can be exploited through recursive or exponentially expanding references. When MarkUs parses instructor-uploaded YAML files without properly restricting alias expansion, an attacker with instructor privileges can craft YAML documents containing deeply nested or recursive alias references.

The attack exploits the "Billion Laughs" pattern (also known as an XML bomb adaptation for YAML), where a small input file can expand to consume massive amounts of memory and CPU resources during parsing. This can lead to application crashes, service unavailability, and potential impact on the underlying server infrastructure.

Root Cause

The root cause is the YAML parser configuration that enables alias expansion without proper restrictions on recursion depth or expansion limits. When processing YAML files for entity creation and updates, the application does not validate or restrict the complexity of alias references, allowing exponential expansion during the parsing phase.

Attack Vector

The attack is network-based and requires high privileges (instructor-level access) to execute. An authenticated instructor can upload a specially crafted YAML file through the assignment settings interface. The malicious YAML file contains alias definitions that reference each other recursively or in a pattern that causes exponential memory expansion when parsed.

The vulnerability affects the availability of the system without impacting confidentiality or integrity. Since instructor privileges are required, the attack surface is limited to authenticated users with elevated access within the MarkUs application.

Detection Methods for CVE-2026-27807

Indicators of Compromise

• Unusual memory consumption spikes on servers hosting MarkUs applications
• Application crashes or unresponsive behavior following YAML file uploads
• Error logs indicating YAML parsing failures or memory allocation errors
• Abnormally large YAML files uploaded through the instructor interface

Detection Strategies

• Monitor application logs for YAML parsing errors or timeout conditions
• Implement file size limits and complexity checks on uploaded YAML documents
• Track memory utilization patterns on MarkUs application servers
• Alert on repeated upload attempts of YAML files from the same user

Monitoring Recommendations

• Configure application performance monitoring to detect resource exhaustion patterns
• Set up alerting thresholds for memory consumption on MarkUs servers
• Review audit logs for instructor YAML file upload activities
• Implement logging for YAML parsing duration and resource consumption

How to Mitigate CVE-2026-27807

Immediate Actions Required

• Upgrade MarkUs to version 2.9.4 or later immediately
• Review recent YAML file uploads for potentially malicious content
• Consider temporarily restricting YAML upload functionality until patch is applied
• Monitor system resources for signs of exploitation

Patch Information

The vulnerability has been patched in MarkUs version 2.9.4. The fix restricts YAML alias expansion to prevent resource exhaustion attacks. Organizations should upgrade to this version or later to address the vulnerability.

For detailed patch information, refer to the GitHub Release v2.9.4 and the GitHub Security Advisory GHSA-m9rx-85mx-q9h6.

Workarounds

• Implement file size limits on YAML uploads to reduce potential impact
• Configure web application firewall rules to inspect YAML content for recursive alias patterns
• Temporarily disable YAML-based entity creation functionality if upgrading is not immediately possible
• Restrict instructor upload permissions to trusted users until patch deployment

# Example: Configure upload size limits in web server (nginx)
client_max_body_size 1M;

# Monitor for unusual memory consumption patterns
watch -n 5 'ps aux --sort=-%mem | head -10'