CVE-2026-24479

HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.

• CWE-22

• https://github.com/zhblue/hustoj/commit/902bd09e6d0011fe89cd84d4236899314b33101fPatch
• https://github.com/zhblue/hustoj/security/advisories/GHSA-xmgg-2rw4-7fxjVendor Advisory

Published

Jan 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24472Hono is a Web application framework that provides support fo…5.3
• CVE-2026-24473Hono is a Web application framework that provides support fo…5.3
• CVE-2026-24474Dioxus Components is a shadcn-style component library for th…5.3
• CVE-2026-24476Shaarli is a personal bookmarking service. Prior to version …5.4
• CVE-2026-24477AnythingLLM is an application that turns pieces of content i…7.5
• CVE-2026-24478AnythingLLM is an application that turns pieces of content i…7.2
• CVE-2026-2448The Page Builder by SiteOrigin plugin for WordPress is vulne…8.8
• CVE-2026-24480QGIS is a free, open source, cross platform geographical inf…8.7
• CVE-2026-24481ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-24484ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-24485ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-24486Python-Multipart is a streaming multipart parser for Python.…7.5