Marmite through 0.4.2 Path Traversal via Development Server
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle_request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable by the marmite process.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rochacbruno | marmite | up to 0.4.2 | — | No fix listed | CNA |
- marmite Vendorrochacbruno Affected up to 0.4.2 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-102810
- 2026-10-03 Alias added: GHSA-wxwc-rm4m-p2q7
References
More rochacbruno vulnerabilities
- TI-2026-65508 Marmite through 0.4.2 Unauthenticated API Access via Development Server CVSS 4.0HIGH 8.7
Sources
- CVE-2026-102810 · CVE Program
- CVE-2026-102810 · NVD
- FIRST EPSS
- GHSA-wxwc-rm4m-p2q7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences