CVE-2026-27933

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Versions prior to 0.133.0 are vulnerable to session hijack via cookie leakage in proxy caches. Version 0.133.0 fixes the issue.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/manyfold3d/manyfold/releases/tag/v0.133.0	Product Release Notes
https://github.com/manyfold3d/manyfold/security/advisories/GHSA-g949-hmvj-2r76	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:manyfold:manyfold:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:27

Type	Values Removed	Values Added
Summary		(es) Manyfold es una aplicación web de código abierto y autoalojada para gestionar una colección de modelos 3D, particularmente enfocada en la impresión 3D. Las versiones anteriores a la 0.133.0 son vulnerables al secuestro de sesión a través de la fuga de cookies en cachés de proxy. La versión 0.133.0 corrige el problema.

27 Feb 2026, 17:27

Type	Values Removed	Values Added
CPE		cpe:2.3:a:manyfold:manyfold::::::::
First Time		Manyfold manyfold Manyfold
References	~~() https://github.com/manyfold3d/manyfold/releases/tag/v0.133.0 -~~	() https://github.com/manyfold3d/manyfold/releases/tag/v0.133.0 - Product, Release Notes
References	~~() https://github.com/manyfold3d/manyfold/security/advisories/GHSA-g949-hmvj-2r76 -~~	() https://github.com/manyfold3d/manyfold/security/advisories/GHSA-g949-hmvj-2r76 - Exploit, Vendor Advisory

26 Feb 2026, 00:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-26 00:16

Updated : 2026-06-17 10:27

NVD link : CVE-2026-27933

Mitre link : CVE-2026-27933

CVE.ORG link : CVE-2026-27933

JSON object : View

Products Affected

manyfold

manyfold

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2026-27933", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27933", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T16:45:19.118722Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "manyfold3d", "product": "manyfold", "versions": [{"status": "affected", "version": "< 0.133.0"}]}]}], "published": "2026-02-26T00:16:26.973", "references": [{"url": "https://github.com/manyfold3d/manyfold/releases/tag/v0.133.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/manyfold3d/manyfold/security/advisories/GHSA-g949-hmvj-2r76", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Versions prior to 0.133.0 are vulnerable to session hijack via cookie leakage in proxy caches. Version 0.133.0 fixes the issue."}, {"lang": "es", "value": "Manyfold es una aplicaci\u00f3n web de c\u00f3digo abierto y autoalojada para gestionar una colecci\u00f3n de modelos 3D, particularmente enfocada en la impresi\u00f3n 3D. Las versiones anteriores a la 0.133.0 son vulnerables al secuestro de sesi\u00f3n a trav\u00e9s de la fuga de cookies en cach\u00e9s de proxy. La versi\u00f3n 0.133.0 corrige el problema."}], "lastModified": "2026-06-17T10:27:55.877", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:manyfold:manyfold:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F54584E-5C84-449F-848F-730DC1BECAC2", "versionEndExcluding": "0.133.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}