A critical OS command injection vulnerability in Manyfold allows authenticated users to execute arbitrary code on the host system through maliciously crafted file uploads.

This vulnerability involves improper neutralization of special elements used in an OS command (CWE-78). An authenticated user can trigger remote code execution by uploading a ZIP file containing a filename with shell metacharacters, which the application unsafely passes to a Ruby backtick call.

Successful exploitation of this vulnerability allows an attacker to gain full control over the underlying server hosting the Manyfold application. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk of data exfiltration, system compromise, and lateral movement within the network. Organizations relying on this software for 3d model management may face severe operational disruption and potential unauthorized access to proprietary assets.

Immediate Action: Update the Manyfold application to version 0.133.0 or later to ensure the command injection flaw is remediated.

Proactive Monitoring: Review system and application logs for unusual file uploads or execution of unexpected shell commands, particularly those involving system utilities.

Compensating Controls: Restrict access to the file upload functionality to trusted users only and implement strict filename validation or sanitization at the web application firewall level to block shell metacharacters.

Public Exploit Available: Unknown

The presence of a known proof-of-concept and the high impact of remote code execution necessitate immediate patching. Administrators should prioritize upgrading to version 0.133.0 to eliminate the underlying injection vector and prevent potential system takeover by authenticated attackers.