CVE-2026-102811highCWE-306

Marmite through 0.4.2 Unauthenticated API Access via Development Server

18Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7

probabilidad de explotación

—

explotación observada

noninguna fuente lo reporta

Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in handle_create_content and handle_clone_content to write files outside the project directory via directory traversal.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Productos afectados

rochacbruno · marmite

Referencias

https://github.com/rochacbruno/marmite https://github.com/rochacbruno/marmite/blob/4b2ddbd7595233b2e1d0086e18490fec49705098/src/content.rs#L1064-L1075 https://github.com/rochacbruno/marmite/blob/4b2ddbd7595233b2e1d0086e18490fec49705098/src/content.rs#L1300-L1322 https://github.com/rochacbruno/marmite/blob/4b2ddbd7595233b2e1d0086e18490fec49705098/src/server.rs#L455-L475 https://github.com/rochacbruno/marmite/commit/303a0bf2fff4302f4164c0c39932fdffc6683ad4 https://github.com/rochacbruno/marmite/issues/554 https://www.vulncheck.com/advisories/marmite-through-0.4.2-unauthenticated-api-access-via-development-server