Threats tagged 'ghsa-wxwc-rm4m-p2q7'

Marmite versions up to 0.4.2 have a path traversal vulnerability in the development server started with the --serve option. This flaw allows unauthenticated attackers to read arbitrary files by exploiting improper handling of encoded path traversal sequences. The vulnerability arises because the handle_request function does not correctly reject '..' segments after percent-decoding the request path, enabling access to files readable by the marmite process.