CVE-2026-24479·PHP vulnerability
HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Attackers can craft a malicious ZIP file containing files with path traversal sequences (e.g., ../../shell.php). When extracted by the server, this allows writing files to arbitrary locations in the web root, leading to Remote Code Execution (RCE). Version 26.01.24 contains a fix for the issue.
- Severity
- critical
- Software
- PHP
- Fixed in
- 26.01.24
- Published
- 2026-01-27
Affected versions
Until: 26.01.24
Fixed in: 26.01.24
How to fix this CVE
Upgrade HUSTOJ to version 26.01.24 or later immediately. If upgrading is not possible, disable the problem import functionality by restricting access to problem_import_qduoj.php and problem_import_hoj.php. Audit the web root for any uploaded web shells. Review Apache/nginx logs for suspicious ZIP upload requests.
# Pull latest image or rebuild:
docker pull hustoj/hustoj:latest
# Or rebuild from source:
git clone https://github.com/zhblue/hustoj.git
cd hustoj && docker build -t hustoj .Defensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
POST /problem_import_qduoj.php HTTP/1.1
Content-Type: multipart/form-data
The attacker uploads a ZIP file containing entries with path traversal in filenames like ../../shell.php. When the server extracts the archive, files are written outside the intended directory, typically placing a PHP web shell in the web root for subsequent command execution.WAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
SecRule FILES_TMPNAMES "@rx \.zip$" "id:20262447,phase:2,chain"
SecRule FILES "@rx (?:\.\.[\/\\])" "deny,status:403,msg:'CVE-2026-24479 ZIP path traversal attempt',severity:CRITICAL"
# Additional rule to block suspicious PHP uploads:
SecRule REQUEST_URI "problem_import" "id:20262448,phase:1,chain"
SecRule REQUEST_METHOD "POST" "deny,status:403,msg:'Block problem import until patched'"How to check if you are affected
- Check HUSTOJ version: grep -r 'version' /var/www/hustoj/package.json 2>/dev/null || git -C /var/www/hustoj log --oneline -1
- Check for web shells dropped via path traversal: find /var/www -name '*.php' -newer /var/log/syslog -mtime -30
- Scan for suspicious PHP files: grep -rl 'eval(base64_decode\|system(\$_\|passthru\|shell_exec' /var/www/
- Check access logs for import endpoint hits: grep 'problem_import' /var/log/apache2/access.log | grep POST
- Verify file permissions on import scripts: ls -la /var/www/hustoj/problem_import_*.php
Indicators of compromise
- POST requests to problem_import_qduoj.php or problem_import_hoj.php with ZIP uploads
- Newly created PHP files outside the expected upload directory
- Files with path traversal sequences in names within upload/temp directories
- Web shells in web root with recent modification timestamps
- Outbound connections from web server process to unknown IPs
FAQ
Is HUSTOJ widely deployed?
HUSTOJ is a popular open source online judge used primarily by universities and competitive programming training centers, especially in China and Southeast Asia. If you run an ACM/ICPC or NOIP training platform, check if it is based on HUSTOJ.
Can this be exploited without authentication?
This depends on the HUSTOJ configuration. In many deployments, the problem import functionality requires admin authentication. However, if the import endpoints are not properly access-controlled, or if an attacker has compromised any admin account, exploitation is straightforward.
How do I check if I was already compromised?
Search for recently created or modified PHP files in your web root: find /var/www -name '*.php' -mtime -30 -exec grep -l 'eval\|system\|exec' {} \;. Also check your access logs for POST requests to problem_import endpoints and review any suspicious outbound network connections.
Does this affect other online judge platforms?
No, this vulnerability is specific to HUSTOJ's problem_import_qduoj.php and problem_import_hoj.php modules. Other online judge platforms (Codeforces, DOMjudge, etc.) have their own codebases and are not affected.
What is the CVSS score and why is it critical?
CVSS 9.8 (Critical) because the attack is network-accessible (AV:N), requires no special privileges (PR:N), needs no user interaction (UI:N), and results in complete system compromise (C:H/I:H/A:H). The public exploit availability makes this especially urgent to patch.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-24479. Free for 1 server.
Get started free