The vulnerability allows authenticated users to rename uploaded files using path traversal sequences. From versions 0.96.0 up to 0.140.0, the file‑rename logic uses the user‑controlled filename in File.join(model.path, filename) without proper sanitization, enabling an attacker to move or create files outside of the configured library directory. This flaw can lead to overwriting or creating arbitrary files on the host file system, potentially compromising confidentiality, integrity, or availability of the system.

Affected installations are those running Manyfold version 0.96.0 through 0.139.x. The specific vendor is Manyfold3D and the product is the Manyfold web application used for managing 3D printing model collections. The flaw is corrected in release 0.140.0 and later.

The CVSS score of 7.1 classifies this flaw as high severity. The EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires the attacker to be an authenticated user; by submitting a rename request with a crafted filename containing traversal characters, the attacker can cause the application to write or overwrite files outside the designated library directory.