CVE-2026-27635

Katalog CVE

CVSS 8.8 · High EPSS 0,56%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada manyfold. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.0, when model render generation is enabled, a logged-in user can achieve RCE by uploading a ZIP containing a file with a shell metacharacter in its name. The filename reaches a Ruby backtick call unsanitized. Version 0.133.0 fixes the issue.

Rincian

Terbit di NVD

26 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 44,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/manyfold3d/manyfold/security/advisories/GHSA-p589-cf26-v7h2 exploit · advisory vendor
• https://github.com/manyfold3d/manyfold/releases/tag/v0.133.0 product · release notes