Marmite through 0.4.2 has missing authentication for its development server API endpoints, allowing unauthenticated users to create, modify, and overwrite site content and configuration via /__marmite__/content, /__marmite__/config, and /__marmite__/file/. The same endpoints also enable path traversal through unsanitized parameters, permitting writes outside the project directory; this flaw can result in full site compromise or arbitrary code execution if configuration files are affected.

The vulnerability affects the Marmite project published by rochacbruno and applies to any installation of Marmite version 0.4.2 or earlier that leaves the development server enabled.

With a CVSS score of 8.7, this flaw is high severity, and the lack of an EPSS score or KEV listing does not diminish its potential impact. Because authentication is absent, an attacker with network access to the exposed development server can trivially exercise the API, achieving arbitrary site modification; exposure to untrusted networks elevates the risk further, while restricting the endpoint to trusted hosts mitigates the threat.