CyberRota Analysis
AI-GeneratedMarmite versions up to 0.4.2 are vulnerable to a path traversal flaw in the development server, which allows unauthenticated attackers to read arbitrary files by exploiting improper handling of encoded traversal sequences. This vulnerability can lead to unauthorized access to sensitive information on the server. Organizations using this software should prioritize patching to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle_request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable by the marmite process.