CVE-2026-27635
Manyfold vulnerable to OS command injection via ZIP filename in f3d render
概要
Manyfold vulnerable to OS command injection via ZIP filename in f3d render
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.0, when model render generation is enabled, a logged-in user can achieve RCE by uploading a ZIP containing a file with a shell metacharacter in its name. The filename reaches a Ruby backtick call unsanitized. Version 0.133.0 fixes the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com