Marmite EUVD-2026-89111

Requires the target to be running Marmite's optional built-in server via the --serve flag AND that server being network-reachable. Pre-0.4.3 the server defaulted to binding 0.0.0.0:8000 (all interfaces), so exposure was the default whenever --serve ran on a routable/LAN host; the /__marmite__/content, /__marmite__/config, and /__marmite__/file/ endpoints then need no authentication and no user interaction. Exploitation is LIMITED by the fact that this is a development-only preview server not intended for production, so production static sites (served by Nginx/Apache) are unaffected; the 0.4.3 fix further limits exposure by defaulting the bind to 127.0.0.1:8000 (loopback-only), requiring an explicit --bind 0.0.0.0:8000 to reintroduce network reach.

The vendor CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N with VI:H, all other impacts N) reflects an unauthenticated, low-complexity network write primitive: the /__marmite__/content, /__marmite__/config, and /__marmite__/file/ endpoints of Marmite's built-in server require no authentication (CWE-306), and unsanitized path parameters in handle_create_content/handle_clone_content permit directory traversal to write files outside the project directory. The integrity-only impact rating is appropriate - the flaw is fundamentally a file-write/content-overwrite issue, not data theft or a crash. The critical mitigating context, confirmed by the patch diff, is that this is explicitly a DEVELOPMENT-only preview/editor server: the real-world risk hinges entirely on network exposure. Pre-patch the default bind was 0.0.0.0:8000 (all interfaces), so a developer running --serve on a routable or LAN-reachable host was exposed by default; the fix changes the default to 127.0.0.1:8000 and relabels the server as not-for-production. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active or automated exploitation - this is a high-CVSS finding whose practical risk is bounded by the requirement that a non-production dev server be network-reachable. Because affected users are developers rather than production servers, treat this as medium priority: patch or restrict binding, but it is not a mass-exploitation-class internet-facing flaw.

A developer runs marmite --serve on a laptop or shared build host, which pre-patch binds to 0.0.0.0:8000 and is reachable over the LAN or an exposed port. An unauthenticated attacker on the same network POSTs to /__marmite__/content or /__marmite__/file/ with a traversal path (e.g. ../../) to overwrite site content, configuration, or files outside the project directory. No public exploit was identified at time of analysis, but the endpoints are trivially reachable given AV:N/AC:L/PR:N.