CVE-2026-46336

7.1 Élevée

Publiée le 16/07/2026 à 20:16 · Modifiée le 18/07/2026 à 05:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/model_file.rb uses the user-controlled filename in File.join(model.path, filename) without sufficient sanitization, allowing files to be moved or written outside the configured library directory. This issue is fixed in version 0.140.0.

Traduire en français

Produits concernés

manyfold3d manyfold

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.1 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L`

Faiblesses (CWE)

CWE-22
CWE-73

Références

https://github.com/manyfold3d/manyfold/commit/ed6a53e54926708594c07d222155ac3a22f93174
https://github.com/manyfold3d/manyfold/pull/6122
https://github.com/manyfold3d/manyfold/releases/tag/v0.140.0
https://github.com/manyfold3d/manyfold/security/advisories/GHSA-j5f9-r7wf-hv37
https://github.com/manyfold3d/manyfold/security/advisories/GHSA-j5f9-r7wf-hv37

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories