CVE-2026-102810

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle_request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable by the marmite process.

• CWE-22

• https://github.com/rochacbruno/marmite
• https://github.com/rochacbruno/marmite/blob/4b2ddbd7595233b2e1d0086e18490fec49705098/src/server.rs#L180-L315
• https://github.com/rochacbruno/marmite/commit/303a0bf2fff4302f4164c0c39932fdffc6683ad4
• https://github.com/rochacbruno/marmite/issues/554
• https://www.vulncheck.com/advisories/marmite-through-0.4.2-path-traversal-via-development-server

Published

Sep 29, 2026

Last Modified

Sep 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102805A flaw has been found in Nothings stb up to 1.16. This affec…6.5
• CVE-2026-102806OpenClaw before 2026.9.5 contains an incorrect authorization…6.3
• CVE-2026-102807OpenClaw before 2026.9.4 contains an incorrect authorization…5.3
• CVE-2026-102808PX4 Autopilot through 1.17.0 contains a NULL pointer derefer…6.5
• CVE-2026-102809PX4 Autopilot through 1.17.0 contains an uncontrolled stack …6.5
• CVE-2026-10281A weakness has been identified in Enderfga claw-orchestrator…7.3
• CVE-2026-102811Marmite through 0.4.2 contains missing authentication in the…7.5
• CVE-2026-102812A hard-coded cryptographic key vulnerability exists in the u…6.9
• CVE-2026-102813An authentication flaw exists in the password-recovery funct…6.1
• CVE-2026-102814An authentication weakness exists in the TP-Link TDDP v2 ser…8.7
• CVE-2026-102815An operating-system command injection vulnerability exists i…6.9
• CVE-2026-102816An authorization vulnerability exists in the country or regi…5.3