https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T14:28:31.276808+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-27635 CVE-2026-27635 — Manyfold vulnerable to OS command injection via ZIP filename in f3d render 2026-10-09T14:28:31.294166+00:00

Affected: manyfold3d manyfold

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.0, when model render generation is enabled, a logged-in user can achieve RCE by uploading a ZIP containing a file with a shell metacharacter in its name. The filename reaches a Ruby backtick call unsanitized. Version 0.133.0 fixes the issue.