A critical path traversal flaw in the marker document-conversion server (through version 2.0.0) allows unauthenticated attackers to write arbitrary files anywhere on the host or delete existing ones.
What Is It
CVE-2026-85684 is a path traversal vulnerability (CWE-73, External Control of File Name or Path) in marker from datalab-to, distributed on PyPI as marker-pdf. The bug lives in the FastAPI /marker/upload handler, which fails to sanitize the file.filename parameter. An attacker who supplies a filename containing directory traversal sequences can cause the server to write files to arbitrary locations on the filesystem, or destroy existing files at those paths.
No credentials and no user interaction are required. The endpoint is reachable over the network, and the attack complexity is low.
Why It Matters
The vulnerability carries a CVSS v3.1 base score of 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, assigned by VulnCheck. A secondary CVSS v4.0 score of 8.8 (HIGH) is also published.
The impact profile is integrity and availability, both rated HIGH, with no confidentiality impact. That maps cleanly to the described behavior: an attacker cannot read your data through this bug, but they can plant files and delete them. Arbitrary file write on a network-exposed service is a well-trodden path to code execution, dropping into startup directories, cron paths, or overwriting application code, and arbitrary file deletion alone is enough to take a service down.
CVE-2026-85684 does not appear in the CISA Known Exploited Vulnerabilities catalog as of publication, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: datalab-to
- Product: marker
- Package:
pkg:pypi/marker-pdf - Affected versions: all versions up to and including 2.0.0
The vulnerable code path is in marker/scripts/server.py. Anyone running the marker FastAPI server, particularly where it is bound to a network-reachable interface rather than the loopback address, should assume they are affected.
Patch Status
Neither the NVD record nor the VulnCheck advisory names a fixed version or specifies a required remediation action. The CVE record was published 2026-09-04 with a status of Received, meaning NVD analysis is still pending.
Until a patched release is confirmed, restrict network access to the marker server and do not expose the /marker/upload endpoint to untrusted networks. Track the upstream issue below for fix status.