The vulnerability is a classic path traversal flaw (CWE‑22) located in the "serve" mode of Marmite. When the development server is started with the --serve option, the request handler joins a percent‑decoded request path to the current workspace without rejecting segments that resolve to parent directories. This allows an unauthenticated HTTP client to request encoded ".." sequences, causing the server to map them to arbitrary file system locations that the Marmite process can read. The effect is the disclosure of any file readable by the process, which can include configuration files or credential stores.

All releases of Marmite up through version 0.4.2 when the development server feature is enabled. The flaw manifests on any operating system where the server binary runs, because the path resolution logic is host‑agnostic. Users who deploy Marmite in a development environment must confirm whether their deployments use version 0.4.2 or earlier and whether the local network makes the development server reachable.

The CVSS score of 8.7 indicates a high severity risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the ease of exploitation remains significant. An attacker can exploit the flaw simply by making an HTTP request to the running instance; no authentication or special privileges are required. Because the request path is permissively accepted after decoding, the attack is straightforward and does not require pre‑existing network access beyond the ability to reach the development server. The lack of a dedicated patch in the public information means that denial of exposure is the primary defense at present.