Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-46336: Manyfold allows logged-in users to rename files outside library

CVE-2026-46336 · published 3 months ago

Summary

If you run Manyfold version 0.96.0 through 0.140.0, a signed‑in user can rename an uploaded file using special path characters, causing the file to be moved or created outside the intended folder. This could let them overwrite or add unwanted files on the server. Update to version 0.140.0 or later to stop the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
manyfold3d	manyfold	>= 0.96.0, < 0.140.0

Original advisory text

Manyfold: Authenticated Path Traversal via File Rename

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/model_file.rb uses the user-controlled filename in File.join(model.path, filename) without sufficient sanitization, allowing files to be moved or written outside the configured library directory. This issue is fixed in version 0.140.0.

References

https://github.com/manyfold3d/manyfold/releases/tag/v0.140.0 URL
https://github.com/manyfold3d/manyfold/security/advisories/GHSA-j5f9-r7wf-hv37 Vendor Advisory
https://github.com/manyfold3d/manyfold/commit/ed6a53e54926708594c07d222155ac3a22... Patch
https://github.com/manyfold3d/manyfold/pull/6122 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46336... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-46336 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

CWE-73External Control of File Name or Path

Timeline

Published16 Jul 2026

Updated4 Nov 2026

First seen16 Jul 2026

Sources

CVE-2026-46336 · NVD

CVE-2026-46336 · MITRE

CVE-2026-46336 · OSV

GHSA-j5f9-r7wf-hv37 · GHSA

Track software like this

Free during beta