Marmite EUVD-2026-89110

Requires the target to be running Marmite's built-in development server via the --serve flag AND that server to be reachable by the attacker - which pre-0.4.3 was the default because --bind defaulted to 0.0.0.0:8000 (all interfaces) rather than loopback. Exploitation is unauthenticated (PR:N) with no user interaction, using percent-encoded .. sequences in the request path. Limiting factors: the affected component is explicitly a development-only preview server not intended for production, impact is read-only to files accessible by the marmite process, and the 0.4.3 patch narrows the default bind to 127.0.0.1, so only hosts running the dev server on a network-facing interface are exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) rates this 8.7, reflecting an unauthenticated, low-complexity network read of arbitrary files (confidentiality-only; VI:N/VA:N). However, the raw score materially overstates real-world urgency because the flaw lives ONLY in the built-in --serve development server, which the vendor's own patch reclassifies as 'development-only, not for production' and re-binds from 0.0.0.0:8000 to loopback 127.0.0.1:8000 - the pre-patch default of binding to all interfaces is precisely what made VC:H network-reachable. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is 'no public exploit identified at time of analysis.' The technical impact is limited to reading files the marmite process can access (no write/RCE), and the deployment surface is a niche Rust static-site generator running an explicitly non-production preview server. Net: a legitimate, patch-worthy confidentiality bug but a LOW-to-MEDIUM real-world priority rather than a true 8.7 emergency, driven down by narrow deployment context and absence of exploitation signals.

A developer runs marmite --serve (or with --bind 0.0.0.0:8000) exposing the preview server on a reachable network interface. An unauthenticated attacker sends an HTTP request with percent-encoded .. traversal sequences (e.g. %2e%2e%2f) that handle_request decodes and joins to the output folder without rejecting parent-directory segments, returning arbitrary files readable by the marmite process such as SSH keys or config files. No public exploit code was provided, but the technique is trivial given AC:L and PR:N.