CVE-2026-102811

HighCVSS 7.5

Published: 29/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in handle_create_content and handle_clone_content to write files outside the project directory via directory traversal.

Risk Assessment

An unauthenticated attacker can take control of site content and configuration, and write files outside the project directory, potentially leading to system integrity compromise.

Recommendation

Upgrade Marmite to a patched version. If not available, restrict access to the development server to trusted networks only.

Other vulnerabilities in Marmite

CVE-2026-102810High
Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle_request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable by the marmite process.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS