CVE-2026-85684: Marker FastAPI Path Traversal Vulnerability

CVE-2026-85684 Overview

CVE-2026-85684 is a path traversal vulnerability in marker versions through 2.0.0. The flaw resides in the FastAPI /marker/upload handler, which does not sanitize the file.filename parameter before writing uploaded content to disk. Unauthenticated remote attackers can supply filenames containing directory traversal sequences to write arbitrary files to any writable location or overwrite existing files on the host. The issue is tracked as CWE-73: External Control of File Name or Path and is documented in the VulnCheck Advisory for Marker.

Critical Impact
Unauthenticated attackers can write or overwrite arbitrary files on hosts running vulnerable marker deployments, enabling code execution and destructive tampering.

Affected Products

marker (datalab-to/marker) versions through 2.0.0
Deployments exposing the FastAPI /marker/upload endpoint from marker/scripts/server.py
Any container or service embedding the vulnerable marker server module

Discovery Timeline

2026-09-04 - CVE-2026-85684 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85684

Vulnerability Analysis

The marker project exposes a FastAPI server that accepts document uploads through the /marker/upload handler defined in marker/scripts/server.py. The handler reads the client-supplied file.filename attribute and joins it directly to a destination directory when persisting the upload. Because the multipart filename is fully attacker-controlled, no basename extraction, no allow-list validation, and no canonical path check are performed before the file is written.

An attacker who can reach the endpoint over the network sends a POST request whose multipart part declares a filename containing ../ sequences or an absolute path. The server resolves the traversal, writes the request body to the resulting location, and returns a normal response. No authentication is required, and the attack completes in a single request. See GitHub Issue #1047 for the upstream tracking discussion.

Root Cause

The root cause is missing input validation on the filename field of the uploaded UploadFile object. FastAPI passes the raw multipart filename to application code without sanitization, and the handler concatenates it into an output path without calling os.path.basename, resolving the canonical path, or verifying that the final path stays within the intended upload directory.

Attack Vector

Exploitation is network-based and unauthenticated. An attacker crafts an HTTP multipart request to /marker/upload where the Content-Disposition header specifies a filename such as ../../../../etc/cron.d/marker or an absolute path like /opt/app/config.py. The server writes attacker-supplied bytes to that destination, permitting arbitrary file write, overwrite of executable scripts or configuration, and, in many deployments, code execution as the service account.

No verified public exploit code is available. Refer to the VulnCheck advisory and the marker source for the vulnerable handler implementation.

Detection Methods for CVE-2026-85684

Indicators of Compromise

HTTP POST requests to /marker/upload where the multipart filename field contains ../, ..\\, URL-encoded traversal sequences (%2e%2e%2f), or a leading /.
New or modified files under system directories (for example /etc/, /usr/local/bin/, ~/.ssh/) whose write time matches upload activity on the marker service.
Unexpected files inside the marker working directory using filenames that resolve outside the configured upload folder.

Detection Strategies

Inspect reverse-proxy or WAF logs for /marker/upload requests and flag any multipart part whose filename parameter contains traversal metacharacters or absolute paths.
Enable filesystem integrity monitoring on directories writable by the marker service account to catch out-of-scope writes.
Correlate process telemetry from the FastAPI worker with file creation events outside the intended upload directory.

Monitoring Recommendations

Forward marker application and web server access logs to a centralized analytics pipeline and alert on filename= values containing .., %2e, or absolute path prefixes.
Baseline expected filenames and MIME types accepted by the endpoint and alert on deviations.
Track outbound and lateral connections from the marker host after upload activity to detect post-exploitation behavior.

How to Mitigate CVE-2026-85684

Immediate Actions Required

Restrict network exposure of the /marker/upload endpoint to trusted networks or place it behind an authenticating reverse proxy until a patch is applied.
Run the marker service as an unprivileged user with a minimal, read-only filesystem outside its designated upload directory.
Audit hosts running marker versions through 2.0.0 for unexpected files created since the service was deployed.

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry. Monitor the datalab-to/marker GitHub repository and GitHub Issue #1047 for a remediated version and upgrade as soon as one becomes available.

Workarounds

Front the FastAPI service with a reverse proxy (for example NGINX) that rejects requests whose multipart body contains traversal sequences in the filename parameter.
Patch the handler locally to sanitize the filename with os.path.basename(file.filename) and verify the resolved path stays within the configured upload directory using os.path.commonpath.
Deploy the service inside a container with a read-only root filesystem and mount only the intended upload directory as writable.

bash

# Example NGINX rule to block traversal patterns in upload filenames
location /marker/upload {
    if ($request_body ~* "filename=\"[^\"]*(\.\./|%2e%2e|/)") {
        return 400;
    }
    proxy_pass http://marker_backend;
}