The vulnerability identified as CVE-2026-27635 affects manyfold3d's manyfold, an open-source web application designed for managing collections of 3D models, particularly for 3D printing workflows. Prior to version 0.133.0, when the model render generation feature is enabled, the application improperly sanitizes filenames within uploaded ZIP archives. Specifically, if a logged-in user uploads a ZIP file containing a file whose name includes shell metacharacters, this filename is directly passed to a Ruby backtick command execution call without proper neutralization. This leads to an OS command injection vulnerability (CWE-78), allowing the attacker to execute arbitrary commands on the underlying server with the privileges of the application process. The vulnerability requires the attacker to be authenticated (logged-in user) but does not require additional user interaction. The CVSS v3.1 base score is 7.5, reflecting high severity due to the potential for full system compromise, impacting confidentiality, integrity, and availability. The flaw is fixed in manyfold version 0.133.0 by properly sanitizing or avoiding unsafe command execution with user-supplied input. No public exploits have been reported yet, but the vulnerability is publicly disclosed and should be considered a significant risk for affected deployments.

Successful exploitation of CVE-2026-27635 can lead to remote code execution on the server hosting manyfold, enabling attackers to execute arbitrary commands with the application's privileges. This can compromise sensitive 3D model data, intellectual property, and potentially allow lateral movement within the network. The attacker could disrupt service availability by executing destructive commands, modify or exfiltrate data, or install persistent backdoors. Since manyfold is used in 3D printing workflows, this could also impact manufacturing processes or product integrity. The requirement for a logged-in user limits exposure somewhat but does not eliminate risk, especially in environments with multiple users or weak authentication controls. The vulnerability affects confidentiality, integrity, and availability, making it a critical concern for organizations relying on manyfold for managing 3D assets.

1. Upgrade manyfold to version 0.133.0 or later immediately to apply the official fix that sanitizes filenames and prevents command injection. 2. Restrict upload permissions to trusted users only and enforce strong authentication mechanisms to reduce the risk of malicious uploads. 3. Implement application-layer input validation and sanitization for all user-supplied data, especially filenames within uploaded archives. 4. Disable model render generation if not required, as this feature is the attack vector. 5. Employ runtime application monitoring and intrusion detection to detect anomalous command execution patterns. 6. Use containerization or sandboxing to limit the impact of potential exploitation. 7. Regularly audit logs for suspicious activity related to file uploads and command execution. 8. Educate users about secure file handling and the risks of uploading untrusted content.