Approved changes feed: RSS · Atom
cpe:2.3:a:manyfold3d:manyfold:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Manyfold3D (415c7b67-a383-5c7a-affb-1a63d291d94a) |
|---|---|
| Product | Manyfold (ab26835c-7113-50ac-bb28-7e704e7fff8f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-46336 |
vulnerable | 2026-07-29 00:54:58.826217 |
Manyfold: Authenticated Path Traversal via File Rename
HIGH (7.1)
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/model_file.rb uses the user-controlled filename in File.join(model.path, filename) without sufficient sanitization, allowing files to be moved or written outside the configured library directory. This issue is fixed in version 0.140.0.
Published: 2026-07-16T17:04:31.056Z
Updated: 2026-07-18T03:01:26.480Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28225 |
vulnerable | 2026-06-08 07:55:15.027485 |
Manyfold has IDOR in ModelFilesController
MEDIUM (5.3)
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.1, the `get_model` method in `ModelFilesController` (line 158-160) loads models using `Model.find_param(params[:model_id])` without `policy_scope()`, bypassing Pundit authorization. All other controllers correctly use `policy_scope(Model).find_param()` (e.g., `ModelsController` line 263). Version 0.133.1 fixes the issue.
Published: 2026-02-26T22:40:17.996Z
Updated: 2026-02-27T18:33:16.833Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27933 |
vulnerable | 2026-06-08 07:55:14.667963 |
Manyfold vulnerable to session hijack via cookie leakage in proxy caches
MEDIUM (6.8)
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Versions prior to 0.133.0 are vulnerable to session hijack via cookie leakage in proxy caches. Version 0.133.0 fixes the issue.
Published: 2026-02-25T23:16:01.572Z
Updated: 2026-02-26T16:45:33.523Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27635 |
vulnerable | 2026-06-08 07:53:22.684522 |
Manyfold vulnerable to OS command injection via ZIP filename in f3d render
HIGH (7.5)
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.0, when model render generation is enabled, a logged-in user can achieve RCE by uploading a ZIP containing a file with a shell metacharacter in its name. The filename reaches a Ruby backtick call unsanitized. Version 0.133.0 fixes the issue.
Published: 2026-02-25T23:10:27.951Z
Updated: 2026-02-26T16:52:18.942Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.