{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "hustoj",
          "vendor": "zhblue",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.01.24"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-27T00:43:42.799Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zhblue/hustoj/security/advisories/GHSA-xmgg-2rw4-7fxj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zhblue/hustoj/security/advisories/GHSA-xmgg-2rw4-7fxj"
        },
        {
          "name": "https://github.com/zhblue/hustoj/commit/902bd09e6d0011fe89cd84d4236899314b33101f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zhblue/hustoj/commit/902bd09e6d0011fe89cd84d4236899314b33101f"
        }
      ],
      "source": {
        "advisory": "GHSA-xmgg-2rw4-7fxj",
        "discovery": "UNKNOWN"
      },
      "title": "HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-24479",
    "datePublished": "2026-01-27T00:43:42.799Z",
    "dateReserved": "2026-01-23T00:38:20.547Z",
    "dateUpdated": "2026-01-27T00:43:42.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23873",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-22T21:54:13.465092Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-22T21:54:23.320Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hustoj",
          "vendor": "zhblue",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 26.01.01"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php). The application fails to sanitize user-supplied input (specifically the \"Nickname\" field) before exporting it to an .xls file (which renders as an HTML table but is opened by Excel). If a malicious user sets their nickname to an Excel formula when an administrator exports and opens the rank list in Microsoft Excel, the formula will be executed. This can lead to arbitrary command execution (RCE) on the administrator\u0027s machine or data exfiltration. A fix was not available at the time of publication."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1236",
              "description": "CWE-1236: Improper Neutralization of Formula Elements in a CSV File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-21T23:26:21.924Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zhblue/hustoj/security/advisories/GHSA-gqwv-v7vx-2qjw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zhblue/hustoj/security/advisories/GHSA-gqwv-v7vx-2qjw"
        }
      ],
      "source": {
        "advisory": "GHSA-gqwv-v7vx-2qjw",
        "discovery": "UNKNOWN"
      },
      "title": "HUSTOJ is Vulnerable to Stored CSV Injection (Formula Injection) in Contest Rank Export"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23873",
    "datePublished": "2026-01-21T23:26:21.924Z",
    "dateReserved": "2026-01-16T21:02:02.899Z",
    "dateUpdated": "2026-01-22T21:54:23.320Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}