CVE-2026-102811

HIGH 7.5

Marmite through 0.4.2 Unauthenticated API Access via Development Server

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in handle_create_content and handle_clone_content to write files outside the project directory via directory traversal.

CWE	CWE-306
Vendor	rochacbruno
Product	marmite
Published	Sep 29, 2026
Last Updated	Sep 29, 2026

Stay Ahead of the Next One

Get instant alerts for rochacbruno marmite

Be the first to know when new high vulnerabilities affecting rochacbruno marmite are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

rochacbruno / marmite

0 ≤ 0.4.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rochacbruno/marmite/issues/554 github.com: https://github.com/rochacbruno/marmite/blob/4b2ddbd7595233b2e1d0086e18490fec49705098/src/server.rs#L455-L475 github.com: https://github.com/rochacbruno/marmite/blob/4b2ddbd7595233b2e1d0086e18490fec49705098/src/content.rs#L1064-L1075 github.com: https://github.com/rochacbruno/marmite/blob/4b2ddbd7595233b2e1d0086e18490fec49705098/src/content.rs#L1300-L1322 github.com: https://github.com/rochacbruno/marmite/commit/303a0bf2fff4302f4164c0c39932fdffc6683ad4 github.com: https://github.com/rochacbruno/marmite vulncheck.com: https://www.vulncheck.com/advisories/marmite-through-0.4.2-unauthenticated-api-access-via-development-server

Credits

Ikram-4