CVE-2026-24479 is a critical (CVSS 9.8) path traversal flaw in HUSTOJ, the open source online judge. The QDUOJ and HOJ problem import modules do not sanitize file names inside uploaded ZIP archives. Versions before 26.01.24 are affected. Upgrade to 26.01.24 or later.
What's affected
The record says HUSTOJ versions prior to 26.01.24 are affected, specifically the problem_import_qduoj.php and problem_import_hoj.php modules. Version 26.01.24 contains the fix.
The flaw is that file names in an uploaded ZIP archive are not sanitized. When the server extracts the archive, a name containing path traversal sequences can place files outside the intended folder, including in the web root. That leads to remote code execution. The CVSS vector needs no privileges and no user interaction.
How to check if you're exposed
Check the version of your HUSTOJ install and compare it with 26.01.24. If you installed from git, check the commit date and compare it with the fix commit in the GitHub advisory.
Also check whether the import pages are reachable without a login, and look in the web root for unexpected PHP files you did not put there.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Update HUSTOJ to 26.01.24 or later.
- Search the web root and upload directories for unexpected files, and investigate any you find.
- Restrict the import pages to administrators on a trusted network.
- Run the web server as a low privilege user, with write access limited to the folders it needs.
- Keep an offline copy of your problem data before upgrading.
Why it matters
The weakness is CWE-22, improper limitation of a pathname to a restricted directory. Archive extraction code has to treat every stored file name as untrusted. If it joins the name onto a base folder without checking where the result lands, the archive controls where files are written.
In a PHP application, writing a script into the web root is enough to run code, which is why a file write bug scores this high. Training sites and contest platforms often run with little hardening. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Archive extraction is a trust boundary
When a program unpacks a ZIP archive, every file name inside is input from whoever made the archive. A name can contain parent folder references that, joined onto the target folder, land the file somewhere else. That is the path traversal pattern, and it has a long history under the name zip slip.
The HUSTOJ advisory describes it in two import modules for problem packages from other judge systems. Import features exist to accept files from outside, so their code needs to assume hostile content.
Safe extraction in general
Resolve the final path of each entry and check that it stays inside the intended folder before writing. Reject absolute paths and entries with parent references. Extract into a temporary folder that is not under the web root, validate the contents, and only then move them. Restrict file types to what the feature needs, so that a script cannot arrive as a problem file.
On your server
Look in the web root for PHP files you did not put there, and for recent changes in folders that import features write to. Check the web server user's permissions: it should be able to write to data folders only, not to code. If your judge machine also runs submitted code, review how submissions are sandboxed, since a compromised web server and a judge on the same host increase the risk.
Operational notes
Online judge sites often belong to schools and clubs, run by volunteers, and are left alone for long periods. Put a name on each instance and a date for the next update review. Restrict import pages to administrators on trusted networks, and keep a recent backup of problems and contest data before any upgrade.
Version 26.01.24 contains the fix.
Quick check
Which version fixes it?
HUSTOJ 26.01.24.
Why is a ZIP upload dangerous?
Because the names inside the archive are attacker controlled, and extraction code that trusts them can write outside the intended folder.
Sources
Last reviewed: 19 October 2026.
