« Volver al listado

CVE-2026-27933

Estado: AnalizadaMedia (6.8)—

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Versions prior to 0.133.0 are vulnerable to session hijack via cookie leakage in proxy caches. Version 0.133.0 fixes the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Manyfold — Manyfold

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-27933",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-27933",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-26T16:45:19.118722Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "manyfold3d",
          "product": "manyfold",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.133.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-26T00:16:26.973",
  "references": [
    {
      "url": "https://github.com/manyfold3d/manyfold/releases/tag/v0.133.0",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/manyfold3d/manyfold/security/advisories/GHSA-g949-hmvj-2r76",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Versions prior to 0.133.0 are vulnerable to session hijack via cookie leakage in proxy caches. Version 0.133.0 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Manyfold es una aplicación web de código abierto y autoalojada para gestionar una colección de modelos 3D, particularmente enfocada en la impresión 3D. Las versiones anteriores a la 0.133.0 son vulnerables al secuestro de sesión a través de la fuga de cookies en cachés de proxy. La versión 0.133.0 corrige el problema."
    }
  ],
  "lastModified": "2026-06-17T10:27:55.877",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:manyfold:manyfold:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F54584E-5C84-449F-848F-730DC1BECAC2",
              "versionEndExcluding": "0.133.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}