What is the CVSS score of CVE-2026-27635?

CVE-2026-27635 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ruby are affected by CVE-2026-27635?

A high-severity vulnerability (CVE-2026-27635) affecting Manyfold, an open-source 3D model management application, poses a significant risk to organizations using this self-hosted solution.

Is there a public PoC exploit available for CVE-2026-27635?

Yes, a public proof-of-concept exploit is available for CVE-2026-27635. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-27635?

Within 24 hours: Inventory all Manyfold instances across the organization and assess internet accessibility; implement network segmentation to restrict access to trusted users only. Within 7 days: Deploy WAF rules to block known attack patterns for CVE-2026-27635 if applicable; disable non-essential features in Manyfold if vulnerability is feature-specific; monitor logs for exploitation attempts. Within 30 days: Maintain daily contact with Manyfold project for patch availability; evaluate alternative solutions if patch timeline extends beyond acceptable risk tolerance; conduct security assessment of Manyfold deployment architecture.

Ruby CVE-2026-27635

HIGH

OS Command Injection (CWE-78)

2026-02-26 security-advisories@github.com

Ruby RCE Manyfold

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 27, 2026 - 18:36 vuln.today

Public exploit code

CVE Published

Feb 26, 2026 - 00:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.0, when model render generation is enabled, a logged-in user can achieve RCE by uploading a ZIP containing a file with a shell metacharacter in its name. The filename reaches a Ruby backtick call unsanitized. Version 0.133.0 fixes the issue.

AnalysisAI

Remote code execution in Manyfold prior to version 0.133.0 allows authenticated users to execute arbitrary commands by uploading a ZIP archive with specially crafted filenames containing shell metacharacters that are passed unsanitized to Ruby backtick execution. The vulnerability affects the model render generation feature and requires an attacker to be logged in, with public exploit code currently available. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as logged-in user

Exploit

Upload ZIP with shell metacharacter in filename

Execution

Trigger model render generation

Impact

Execute arbitrary code via backtick evaluation

Access

Authenticate as logged-in user

Exploit

Upload ZIP with shell metacharacter in filename

Execution

Trigger model render generation

Impact

Execute arbitrary code via backtick evaluation

Vulnerability AssessmentAI

Exploitation	Model render generation must be enabled in Manyfold configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.5 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker (requires authentication) could exploit this vulnerability to compromise the affected system.
Remediation	Monitor vendor advisories for a patch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all Manyfold instances across the organization and assess internet accessibility; implement network segmentation to restrict access to trusted users only. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-27635 vulnerability details – vuln.today

Back

Ruby CVE-2026-27635

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Share

External POC / Exploit Code