Threat database

Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in handle_create_content and handle_clone_content to write files outside the project directory via directory traversal.

Marmite versions up to 0.4.2 have a path traversal vulnerability in the development server started with the --serve option. This flaw allows unauthenticated attackers to read arbitrary files by exploiting improper handling of encoded path traversal sequences. The vulnerability arises because the handle_request function does not correctly reject '..' segments after percent-decoding the request path, enabling access to files readable by the marmite process.