CVE-2026-102811: Rochacbruno Marmite

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in handle_create_content and handle_clone_content to write files outside the project directory via directory traversal.

Affected products

• Rochacbruno Marmite: up to and including 0.4.2

Published 2026-09-29. Last modified 2026-09-30.