Vulnerability Description
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/model_file.rb uses the user-controlled filename in File.join(model.path, filename) without sufficient sanitization, allowing files to be moved or written outside the configured library directory. This issue is fixed in version 0.140.0.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/manyfold3d/manyfold/commit/ed6a53e54926708594c07d222155ac3a22
- https://github.com/manyfold3d/manyfold/pull/6122
- https://github.com/manyfold3d/manyfold/releases/tag/v0.140.0
- https://github.com/manyfold3d/manyfold/security/advisories/GHSA-j5f9-r7wf-hv37
- https://github.com/manyfold3d/manyfold/security/advisories/GHSA-j5f9-r7wf-hv37
FAQ
What is CVE-2026-46336?
CVE-2026-46336 is a vulnerability with a CVSS score of 7.1 (HIGH). Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded ...
How severe is CVE-2026-46336?
CVE-2026-46336 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-46336?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.