CVE-2026-46336

🗓️ 16 Jul 2026 17:04:31Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 52 Views🌐 WEB

Authenticated users can rename files with path traversal in Manyfold before 0.140.0, enabling writes outside the library.

Reporter	Title	Published	Views	Family All 8
attackerkb	CVE-2026-46336	16 Jul 202617:04	–	attackerkb
Cvelist	CVE-2026-46336 Manyfold: Authenticated Path Traversal via File Rename	16 Jul 202617:04	–	cvelist
EUVD	EUVD-2026-44989	16 Jul 202617:04	–	euvd
Mend	CVE-2026-46336	16 Jul 202617:04	–	mend
NVD	CVE-2026-46336	16 Jul 202618:16	–	nvd
Positive Technologies	PT-2026-60527	16 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-46336: Improper Limitation of a Pathname to a Restricted Directory	16 Jul 202600:00	–	rapid7
Vulnrichment	CVE-2026-46336 Manyfold: Authenticated Path Traversal via File Rename	16 Jul 202617:04	–	vulnrichment

Vulners

Node

manyfold manyfoldRange0.96.0–0.140.0

[
  {
    "vendor": "manyfold3d",
    "product": "manyfold",
    "versions": [
      {
        "version": ">= 0.96.0, < 0.140.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/manyfold3d/manyfold/security/advisories/GHSA-j5f9-r7wf-hv37
github	www.github.com/manyfold3d/manyfold/pull/6122
github	www.github.com/manyfold3d/manyfold/commit/ed6a53e54926708594c07d222155ac3a22f93174
github	www.github.com/manyfold3d/manyfold/releases/tag/v0.140.0

Parameter	Position	Path	Description	CWE
filename	path	/models/model_file.rb	Authenticated users can rename uploaded files using path traversal sequences in the filename parameter, allowing files to be written outside the configured library directory.	CWE-22, CWE-73

24 Oct 2026 20:10Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.1

EPSS0.00391

SSVC