Marker FastAPI Upload Endpoint Path Traversal (CVE-2026-85684)

Technical Analysis

The vulnerability (CVE-2026-85684, CVSS 9.1) resides in Marker's FastAPI-based upload handler, which accepts user-supplied filenames without validating or normalizing directory traversal sequences (e.g., ../../). This allows unauthenticated attackers to craft malicious filenames that escape the intended upload directory, enabling arbitrary file writes to sensitive locations such as cron directories, systemd service files, SSH authorized_keys, or web-accessible directories to achieve remote code execution, as well as deletion of critical system or application files. Exploitation requires only a crafted HTTP multipart upload request, making this trivially automatable and scannable at scale. Marker is commonly deployed as a document-to-markdown/PDF conversion microservice, often integrated into RAG (retrieval-augmented generation) ingestion pipelines and AI agent document-processing workflows, meaning a successful compromise could allow attackers to plant malicious payloads, poison ingested documents, exfiltrate API keys/config files used by agent orchestration systems, or pivot into the broader agent infrastructure.

Affected Systems

Marker document processing tool, all versions through 2.0.0, specifically deployments exposing the FastAPI /marker/upload HTTP endpoint

Indicators of Compromise

• N/A - vulnerability disclosure without known active exploitation indicators at time of publication; monitor for suspicious multipart upload requests to /marker/upload containing '../' or encoded traversal sequences (%2e%2e%2f) in the filename field

Remediation Steps

1. 1

   Upgrade Marker

   Update to a patched version of Marker beyond 2.0.0 once released by the maintainers; monitor the project's repository/advisories for the fix.

2. 2

   Input Validation Workaround

   If unable to upgrade immediately, deploy a reverse proxy or WAF rule to block requests containing path traversal sequences (../, ..%2f, %2e%2e) in multipart filename fields.

3. 3

   Restrict Network Exposure

   Ensure the Marker /marker/upload endpoint is not exposed directly to the internet; require authentication and network-level access controls (VPN, allowlisting) for internal-only use.

4. 4

   Filesystem Hardening

   Run the Marker service with least-privilege file permissions and in a containerized/sandboxed environment to limit blast radius of arbitrary file write/delete.

5. 5

   Audit RAG/Agent Pipelines

   Organizations using Marker within document ingestion or RAG pipelines for AI agents should audit for unauthorized file modifications, review logs for anomalous upload requests, and rotate any credentials or API keys stored on the host.