Security fix: path traversal in 3MF import #240

New Issue

MrUnknownDE · 2026-04-05T16:19:15+02:00

MrUnknownDE commented

2026-04-05 16:19:15 +02:00

Originally created by @SoftFever on 3/20/2026

Description

This addresses a vulnerability in 3MF loading.

A path traversal vulnerability exists in OrcaSlicer’s .3mf file handling. Opening a crafted .3mf file can write files to arbitrary locations on the filesystem, potentially leading to remote code execution.

Special thanks to Zekun for reporting and analyzing the issue and providing a solution!

Screenshots/Recordings/Graphs

Tests

*Originally created by @SoftFever on 3/20/2026* # Description This addresses a vulnerability in 3MF loading. A path traversal vulnerability exists in OrcaSlicer’s `.3mf` file handling. Opening a crafted `.3mf` file can write files to arbitrary locations on the filesystem, potentially leading to remote code execution. Special thanks to Zekun for reporting and analyzing the issue and providing a solution! # Screenshots/Recordings/Graphs  ## Tests

MrUnknownDE closed this issue

2026-04-05 16:19:15 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/OrcaSlicer#240