CVE-2026-102810

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle_request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable by the marmite process.

• CWE-22

• https://github.com/rochacbruno/marmite
• https://github.com/rochacbruno/marmite/blob/4b2ddbd7595233b2e1d0086e18490fec49705098/src/server.rs#L180-L315
• https://github.com/rochacbruno/marmite/commit/303a0bf2fff4302f4164c0c39932fdffc6683ad4
• https://github.com/rochacbruno/marmite/issues/554
• https://www.vulncheck.com/advisories/marmite-through-0.4.2-path-traversal-via-development-server

Published

Sep 29, 2026

Last Modified

Sep 29, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10280A security flaw has been discovered in horizon921 mcpilot 0.…7.3
• CVE-2026-102806OpenClaw before 2026.9.5 contains an incorrect authorization…6.3
• CVE-2026-102807OpenClaw before 2026.9.4 contains an incorrect authorization…5.3
• CVE-2026-102808PX4 Autopilot through 1.17.0 contains a NULL pointer derefer…6.5
• CVE-2026-102809PX4 Autopilot through 1.17.0 contains an uncontrolled stack …6.5
• CVE-2026-10281A weakness has been identified in Enderfga claw-orchestrator…7.3
• CVE-2026-102811Marmite through 0.4.2 contains missing authentication in the…7.5
• CVE-2026-10282A security vulnerability has been detected in Bottelet Dayby…5.3
• CVE-2026-102820pageant provides a [PageantStream] type that implements [Asy…6.2
• CVE-2026-102821Russh is a Rust SSH client and server library. Prior to 0.63…6.5
• CVE-2026-102822Russh is a Rust SSH client and server library. Prior to 0.63…3.7
• CVE-2026-102823Russh is a Rust SSH client and server library. Prior to 0.63…7.5