CVE-2026-85953 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution under an unintended identity.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Progress MarkLogic Server versions prior to 12.1.0 for the 12.x branch and before 11.3.7 for the 11.x branch stems from insufficient validation of user-controlled inputs within privileged legacy InfoStudio modules. These specific components, which are part of the server's administrative interface infrastructure, fail to properly sanitize or verify file paths and context values provided by users during request processing. This lack of rigorous input validation creates a pathway for attackers to manipulate internal operations that require elevated privileges, effectively bypassing intended security controls through improper handling of directory traversal sequences or identity impersonation vectors.
From a technical perspective, the core flaw is classified under CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-270 Privilege Context Switching Error. The legacy InfoStudio modules process file system operations based on user-supplied data without adequately restricting access to authorized directories or verifying that the executing context matches the intended administrative role. When an attacker supplies crafted input containing relative path sequences such as dot-dot-slash, they can redirect read or write operations outside of designated sandboxed areas. Similarly, by manipulating user-context values, an actor may trick the server into performing actions under a different identity than originally authenticated, leading to unauthorized access to sensitive configuration files, database backups, or internal logs that are typically protected from standard users.
The operational impact of this vulnerability is significant for organizations relying on MarkLogic Server for critical data management and application development. Successful exploitation allows an attacker with network access to the administrative interface to read arbitrary files from the server's file system, potentially exposing credentials, private keys, or proprietary business logic stored in configuration directories. Furthermore, if the module supports write operations, it could lead to remote code execution by overwriting executable scripts or libraries within privileged paths. This compromises the integrity and confidentiality of the entire deployment, as attackers can pivot from information disclosure to full system compromise, disrupting service availability and violating data protection compliance requirements such as GDPR or HIPAA depending on the nature of stored data.
Mitigation strategies primarily involve upgrading to patched versions where these legacy modules have been either removed, deprecated with strict access controls, or updated to enforce rigorous input validation and path canonicalization. Organizations should immediately apply version 12.1.0 or later for MarkLogic Server 12.x releases and version 11.3.7 or later for the 11.x branch. In environments where immediate patching is not feasible due to operational constraints, administrators should disable access to the InfoStudio administrative interface if it is not actively required for daily operations. Additionally, implementing network segmentation to restrict access to management ports from untrusted networks and monitoring logs for unusual file system access patterns can provide temporary defense-in-depth measures against exploitation attempts associated with CWE-20 Improper Input Validation and ATT&CK technique T1530 Data from Cloud Storage Object or T1078 Valid Accounts.