PT-2026-60527 · Manyfold3D · Manyfold

CVE-2026-46336 · Publicado 2026-07-16 · Atualizado 2026-07-16

Mitre

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/model file.rb uses the user-controlled filename in File.join(model.path, filename) without sufficient sanitization, allowing files to be moved or written outside the configured library directory. This issue is fixed in version 0.140.0.

Correção

Path traversal

Enumeração de Fraquezas

CWE-73

CWE-22

Identificadores relacionados

CVE-2026-46336

Produtos afetados

Manyfold

Referências · 5

• https://github.com/manyfold3d/manyfold/security/advisories/GHSA-j5f9-r7wf-hv37 · Nota
• https://github.com/manyfold3d/manyfold/releases/tag/v0.140.0 · Nota
• https://github.com/manyfold3d/manyfold/commit/ed6a53e54926708594c07d222155ac3a22f93174 · Nota
• https://github.com/manyfold3d/manyfold/pull/6122 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-46336 · Nota de Segurança