PT-2026-60527 · Manyfold3D · Manyfold

CVE-2026-46336 · Published 2026-07-16 · Updated 2026-07-16

Mitre

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/model file.rb uses the user-controlled filename in File.join(model.path, filename) without sufficient sanitization, allowing files to be moved or written outside the configured library directory. This issue is fixed in version 0.140.0.

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2026-46336

Affected Products

Manyfold

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-46336 · Security Note
• https://github.com/manyfold3d/manyfold/security/advisories/GHSA-j5f9-r7wf-hv37 · Note
• https://github.com/manyfold3d/manyfold/releases/tag/v0.140.0 · Note
• https://github.com/manyfold3d/manyfold/commit/ed6a53e54926708594c07d222155ac3a22f93174 · Note
• https://github.com/manyfold3d/manyfold/pull/6122 · Note