CVE-2026-102811 — Marmite through 0.4.2 Unauthenticated API Access via Development Server
Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthentic…
Published: 2026-09-29 · CVSS: 8.7 · CVSS 4.0
Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in handle_create_content and handle_clone_content to write files outside the project directory via directory traversal.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7