Summary

Manyfold allows authenticated users to rename uploaded files using path traversal sequences.

The filename field is user-controlled and later used in filesystem paths without proper sanitization:

File.join(model.path, filename)

By renaming a file to:

../../outside.stl

the application writes the file outside the configured library directory.

PoC

1. Upload a valid model file.
2. Rename it to:

../../outside.stl

3. Save changes.
4. Inside the container:

find / -name outside.stl 2>/dev/null

Result:

/outside.stl

Impact

Authenticated users able to edit files can write/move files outside the intended storage directory.