CVE-2026-46336

Name of the Vulnerable Software and Affected Versions Manyfold versions 0.96.0 through 0.139.0

Description Authenticated users can rename uploaded files using path traversal sequences. This occurs because the app/models/model file.rb file utilizes a user-controlled filename within the File.join(model.path, filename) function without sufficient sanitization. Path traversal is a technique used to access files and directories that are stored outside the web root folder. This flaw allows files to be moved or written outside the configured library directory.

Recommendations Update Manyfold to version 0.140.0.