CVE-2026-27635

Published: Feb 26, 2026Modified: Feb 27, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.0, when model render generation is enabled, a logged-in user can achieve RCE by uploading a ZIP containing a file with a shell metacharacter in its name. The filename reaches a Ruby backtick call unsanitized. Version 0.133.0 fixes the issue.

Affected (1)

Products: Manyfold: Manyfold

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Manyfold Manyfold	Before 0.133.0

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://github.com/manyfold3d/manyfold/releases/tag/v0.133.0

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/manyfold3d/manyfold/security/advisories/GHSA-p589-cf26-v7h2

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.