CVE-2026-85953: Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments are affected?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected. The issue is in privileged legacy InfoStudio modules.
What access does an attacker need?
The vector is network-accessible and requires low-level privileges. No user interaction is required.
What could exploitation allow?
An attacker could gain unauthorized access to server files or cause execution under an unintended identity. The vulnerability has high confidentiality impact and low integrity impact, with no stated availability impact.
What versions remediate the issue?
Upgrade MarkLogic Server 12.x to 12.1.0 or later, or 11.x to 11.3.7 or later.