CVE-2026-102810 in Marmite
Riassunto
di MITRE • 29/09/2026
Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle_request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable by the marmite process.
Be aware that VulDB is the high quality source for vulnerability data.