CVE-2026-102810: Path Traversal in Marmite Development Server

Q: How is this vulnerability fixed?

The vulnerability is fixed in commit 303a0bf2fff4302f4164c0c39932fdffc6683ad4, which adds validation to reject path traversal segments after decoding and joining. Users should update to a version of Marmite that incorporates this fix and avoid exposing the development server to untrusted networks.

Summary

CVE-2026-102810 describes a high-severity path traversal vulnerability in Marmite, a static site generator, affecting versions through 0.4.2. The vulnerability exists in the development server that is started with the --serve flag. The handle_request function in src/server.rs fails to reject .. path segments after percent-decoding and joining the request path to the output folder. This allows unauthenticated remote attackers to send encoded traversal sequences and read arbitrary files accessible to the Marmite process. The vulnerability has a CVSS 4.0 base score of 8.7 (High), reflecting its network-exploitable, unauthenticated nature with high confidentiality impact.

Technical Analysis

Marmite is a static site generator written in Rust. When a developer runs marmite --serve, the tool starts a local HTTP development server to preview the generated site. The server is implemented in src/server.rs, and the core request-handling logic resides in the handle_request function, which spans lines 180 through 315 of the vulnerable version.

The vulnerability arises from the way the server processes incoming HTTP request paths. When a client requests a resource, the server takes the requested path, percent-decodes it, and then joins it to the output folder path to construct the full filesystem path of the file to serve. The critical flaw is that after this decoding and joining operation, the server does not check whether the resulting path contains .. segments that would escape the intended output directory.

Percent-decoding is the process of converting URL-encoded characters back to their original form. For example, %2e decodes to a period (.), and %2f decodes to a forward slash (/). An attacker can craft a URL that, when decoded, produces a path containing ../ sequences. Because the server decodes the path before joining it to the output folder and does not subsequently validate or sanitize the result, these traversal segments are preserved in the final filesystem path.

The sequence of events is as follows: the attacker sends an HTTP GET request containing an encoded path such as %2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd. The server percent-decodes this to ../../../etc/passwd. It then joins this decoded path to the output folder, for example /home/user/site/output, producing a path like /home/user/site/output/../../../etc/passwd. When the server attempts to read and serve this file, the operating system resolves the .. segments, effectively traversing up the directory tree to /etc/passwd. The server then returns the contents of that file in the HTTP response.

The root cause is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability. The fix, as indicated by the commit referenced in the advisory, involves adding validation to reject or normalize paths that contain .. segments after decoding and joining. Proper implementations typically canonicalize the resulting path and verify that it still falls within the intended output directory boundary.

The CVSS 4.0 vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N provides further context. The attack vector is network-based (AV:N), meaning the vulnerability can be exploited remotely. The attack complexity is low (AC:L), requiring no special conditions. No privileges are required (PR:N), and no user interaction is needed (UI:N). The vulnerability has high confidentiality impact (VC:H) because arbitrary file reads can expose sensitive data. There is no integrity or availability impact on the vulnerable system itself.

Affected Software and Versions

Vendor: (Not specified in NVD data)
Product: Marmite
Affected versions: Through 0.4.2 (inclusive)
Fixed version: Available in commit 303a0bf2fff4302f4164c0c39932fdffc6683ad4 (subsequent to 0.4.2)

The vulnerability specifically affects the development server feature activated via the --serve command-line flag. Production deployments that only generate static files without running the built-in server are not directly affected by this specific vulnerability, though the vulnerable code is present in all versions through 0.4.2.

Impact

The primary impact of CVE-2026-102810 is unauthorized disclosure of sensitive information. An unauthenticated attacker who can reach the Marmite development server over the network can read any file that the Marmite process has permissions to access. This includes:

Configuration files containing secrets, API keys, or database credentials
Source code of the project being built
System files such as /etc/passwd, /etc/shadow (if running with elevated privileges), and other operating system configuration files
SSH keys and other authentication materials stored in user home directories
Environment files and application configuration that may contain sensitive runtime data
Any other files within the filesystem that are readable by the user account running the Marmite process

The confidentiality impact is rated as high (VC:H) in the CVSS vector, reflecting the potential for significant data exposure. While there is no direct integrity or availability impact (VI:N, VA:N), the information disclosed through this vulnerability can be leveraged for further attacks. For example, exposed credentials could be used to compromise additional systems, and exposed source code could reveal other vulnerabilities.

It is important to note that development servers are sometimes exposed beyond localhost. Developers may bind the server to 0.0.0.0 to share previews with colleagues, or the server may be inadvertently accessible through network misconfigurations, container port mappings, or reverse proxy setups. In such cases, the attack surface extends to any network participant who can reach the server port.

Exploitation Scenario

Consider a development team using Marmite to build a documentation site. A developer runs marmite --serve on their workstation to preview changes. The development server starts and listens on a port, defaulting to localhost. However, the developer is working within a containerized environment or has configured the server to listen on all interfaces to share the preview with a remote collaborator.

An attacker who can reach the development server port sends an HTTP GET request with a crafted path. The request path contains percent-encoded traversal sequences designed to navigate above the output directory. For example, the attacker might request a path that decodes to ../../../../etc/passwd or ../../../../home/user/.ssh/id_rsa. The server decodes the path, joins it to the output folder, and attempts to read the resulting file. Because no validation rejects the .. segments, the server reads the target file and returns its contents in the HTTP response body.

The attacker does not need credentials, does not need to interact with any user, and does not need to exploit any additional vulnerabilities. The attack is a single HTTP request that can be repeated to enumerate and read multiple files across the filesystem. The simplicity and reliability of the exploit contribute to the low attack complexity rating (AC:L).

In a cloud or CI/CD environment, the impact could be even more severe. If Marmite is used in a build pipeline with the development server temporarily started for testing, and the build runner has access to cloud credentials or deployment keys, an attacker could exfiltrate those credentials and pivot to compromise the broader infrastructure.

Proof-of-Concept: curl and Burp

Based on the vulnerability description and the referenced source code, the following proof-of-concept demonstrates how the path traversal can be exploited using common tools. The development server must be running and reachable.

Using curl

The simplest exploitation method uses curl to send a request with encoded traversal sequences. Assuming the Marmite development server is running on http://localhost:8000, the following command attempts to read /etc/passwd:

curl --path-as-is "http://localhost:8000/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd"

The --path-as-is flag tells curl to send the path exactly as specified without normalizing it. The percent-encoded sequences %2e%2e%2f represent ../ after decoding. The number of ../ segments needed depends on the depth of the output directory within the filesystem. The attacker can adjust the number of traversal segments to reach the desired file.

Alternatively, a mixed encoding approach can be used:

curl --path-as-is "http://localhost:8000/..%2f..%2f..%2f..%2fetc%2fpasswd"

This variant uses literal .. characters combined with encoded slashes (%2f). Depending on how the server processes the path before decoding, different encoding strategies may be more or less effective.

Using Burp Suite

Using Burp Suite Proxy, the attacker can intercept and modify requests to the development server. The steps are as follows:

Configure the browser to route traffic through Burp Suite Proxy.
Navigate to the Marmite development server URL in the browser (e.g., http://localhost:8000).
In Burp's Proxy tab, intercept the HTTP request.
Modify the request path in the intercepted request to include encoded traversal sequences. For example, change GET / HTTP/1.1 to GET /%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd HTTP/1.1.
Forward the modified request.
Observe the response in the HTTP history tab. If the vulnerability is present, the response body will contain the contents of the target file.

In Burp Repeater, the attacker can iterate more efficiently:

Send a request to the development server from the browser through Burp Proxy.
Right-click the request in HTTP history and select "Send to Repeater."
In the Repeater tab, modify the request path to include traversal sequences.
Click Send and review the response.
Adjust the number of ../ segments and target file path as needed, repeating the process to enumerate readable files.

Detection and Mitigation

Detection

Organizations can detect exploitation attempts by monitoring HTTP requests to Marmite development servers for path traversal patterns. Key indicators include:

HTTP requests containing %2e, %2f, or other percent-encoded path separators in the request URI
Requests containing literal .. sequences in the path
Requests for files outside expected web content types (e.g., requests for passwd, id_rsa, .env, or configuration file extensions)
Unusual response sizes from the development server, indicating file contents being returned rather than expected HTML pages
HTTP 200 responses for paths that do not correspond to known site content

Network-level monitoring can also identify suspicious connections to development server ports, especially from external or unexpected source IP addresses.

Mitigation

The primary mitigation is to update Marmite to a version that includes the fix. The fix is available in commit 303a0bf2fff4302f4164c0c39932fdffc6683ad4, which addresses the path traversal issue in src/server.rs. Users should update to the latest version of Marmite that incorporates this fix.

Additional mitigations include:

Restrict network access: Ensure the development server is only accessible from localhost. Avoid binding to 0.0.0.0 or public interfaces. If remote access is needed, use SSH tunneling or a VPN rather than exposing the server directly.
Run with minimal privileges: Run the Marmite process with the least privileges necessary. Avoid running as root or with access to sensitive directories. This limits the files an attacker can read even if the vulnerability is exploited.
Use containerization: Run the development server inside a container with a read-only filesystem and minimal mounted volumes. This constrains the files accessible through path traversal.
Do not use --serve in production: The development server is intended for local preview only. Production deployments should serve the generated static files using a hardened web server such as nginx or Apache, not the built-in Marmite server.
Firewall rules: Apply firewall rules to block inbound connections to development server ports from untrusted networks.

Bug Bounty Angle

CVE-2026-102810 represents a straightforward but impactful vulnerability that is well-suited for bug bounty programs and security research. Several aspects make this vulnerability notable from a bug bounty perspective:

Simplicity of discovery: The vulnerability can be discovered through source code review of the handle_request function in src/server.rs. The absence of path validation after decoding and joining is a recognizable pattern that security researchers routinely check for. Automated tools and manual review can both identify this class of vulnerability.

Clear exploitability: The path traversal can be reliably exploited with a single HTTP request. There is no need for complex exploit chains, race conditions, or bypasses. This makes the vulnerability easy to demonstrate in a bug bounty report, which strengthens the submission.

High impact: Arbitrary file read vulnerabilities can expose sensitive information including credentials, source code, and configuration data. Bug bounty programs typically value vulnerabilities that demonstrate real-world impact, and the ability to read files like /etc/passwd or application configuration files provides clear evidence of impact.

Common pattern: Path traversal vulnerabilities in development servers and file-serving functionality are a well-known class of bugs. Researchers who specialize in this area can efficiently test for similar issues across multiple projects. The pattern of percent-decoding before path validation is a recurring mistake that appears in many codebases.

Responsible disclosure: The vulnerability was reported through GitHub issue #554 and addressed in a specific commit. This demonstrates a responsible disclosure process and highlights the importance of maintaining accessible reporting channels for security researchers.

For researchers looking for similar vulnerabilities, key areas to investigate include any HTTP server functionality that serves files from a filesystem directory, particularly where user-supplied paths are decoded, joined, or concatenated without subsequent validation or canonicalization checks.

Frequently Asked Questions

What is CVE-2026-102810?

CVE-2026-102810 is a path traversal vulnerability in Marmite through version 0.4.2. The vulnerability exists in the development server started by the --serve flag, specifically in the handle_request function in src/server.rs, which fails to reject .. path segments after percent-decoding and joining the request path to the output folder.

How can an attacker exploit this vulnerability?

An unauthenticated attacker can send an HTTP request to the Marmite development server containing percent-encoded path traversal sequences (such as %2e%2e%2f for ../). The server decodes and joins the path without validation, allowing the attacker to traverse above the output directory and read arbitrary files accessible to the Marmite process.

How is this vulnerability fixed?

The vulnerability is fixed in commit 303a0bf2fff4302f4164c0c39932fdffc6683ad4, which adds validation to reject path traversal segments after decoding and joining. Users should update to a version of Marmite that incorporates this fix and avoid exposing the development server to untrusted networks.