hustoj vulnerabilities

2 known vulnerabilities in hustoj from Zhblue. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  hustoj: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-24479Jan 27, 2026ZhblueEPSS 8.13%

  HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Atta

• 9.0 Critical severity

  hustoj: Improper Neutralization of Formula Elements in a CSV File

  CVE-2026-23873Jan 22, 2026Zhblue

  hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php