---
id: CVE-2026-85684
title: >-
  marker through 2.0.0 contains a path traversal vulnerability in the FastAPI
  /marker/upload handler that fails to sanitize the file.filename parameter
summary: >-
  marker through 2.0.0 contains a path traversal vulnerability in the FastAPI
  /marker/upload handler that fails to sanitize the file.filename parameter.
  Unauthenticated attackers can supply filenames containing directory traversal
  sequence…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-73
vendor: datalab-to
product: marker
affected:
  - marker <= 2.0.0
published: '2026-09-04'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:46.567'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85684'
references:
  - url: 'https://github.com/datalab-to/marker'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/datalab-to/marker/blob/v2.0.0/marker/scripts/server.py'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/datalab-to/marker/issues/1047'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/marker-through-2.0.0-path-traversal-via-upload-filename
    label: disclosure@vulncheck.com
  - url: 'https://github.com/datalab-to/marker/issues/1047'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00657
epssPercentile: 0.50077
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-08T17:07:09.983540Z'
ingestedAt: '2026-09-08T19:08:49.592Z'
---

## Overview

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.