Executive brief
Manyfold is a self-hosted web application used to manage and organize 3D model collections for 3D printing. A security flaw allows logged-in users to move or rename files into unauthorized locations on the server's file system. This could allow an attacker to disrupt the application's operations or overwrite sensitive files outside of the intended storage area.
Technical details
A path traversal vulnerability (CWE-22) exists in Manyfold's file renaming logic within 'app/models/model_file.rb'. The application uses a user-provided filename in a 'File.join' operation without sufficient sanitization. An authenticated attacker with network access can provide a filename containing traversal sequences (e.g., '../../filename') to move files outside the configured library directory. This can lead to unauthorized file manipulation or potential service disruption. The issue is resolved in version 0.140.0 by implementing proper filename sanitization.
Affected products
- Manyfold3d Manyfold >= 0.96.0, < 0.140.0
Timeline
- 2026-05-13: patched: Fix merged and version 0.140.0 released
- 2026-07-16: disclosed: CVE-2026-46336 published