CVE-2026-46336
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/model_file.rb uses the user-controlled filename in File.join(model.path, filename) without sufficient sanitization, allowing files to be moved or written outside the configured library directory. This issue is fixed in version 0.140.0.
Fraqueza
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/model_file.rb uses the user-controlled filename in File.join(model.path, filename) without sufficient sanitization, allowing files to be moved or written outside the configured library directory. This issue is fixed in version 0.140.0.
Referências
- https://github.com/manyfold3d/manyfold/commit/ed6a53e54926708594c07d222155ac3a22f93174
- https://github.com/manyfold3d/manyfold/pull/6122
- https://github.com/manyfold3d/manyfold/releases/tag/v0.140.0
- https://github.com/manyfold3d/manyfold/security/advisories/GHSA-j5f9-r7wf-hv37
- https://github.com/manyfold3d/manyfold/security/advisories/GHSA-j5f9-r7wf-hv37
Encontre a falha antes de um atacante.
Entre com o GitHub e rode sua primeira auditoria em menos de um minuto. O plano gratuito não exige cartão de crédito.