CVE-2025-58180

CVE-2025-58180 OctoPrint のファイルアップロードにおける無害化されていないファイル名によるRCE OctoPrint バージョン =1.11.2 において、ファイルアップロードアクセス（有効なAPIキーやセッションなど）を持つ攻撃者は、サニタイズ（無害化）をバイパスし、後に OctoPrint のイベントシステムによって実行される悪意のあるファイル名を作成できます。これにより、ホスト上でリモートコード実行（RCE）が発生します。 PoC: 脆弱性再現の手順 ステップ 1: バージョン情報 最新安定版リリースをダウンロード: OctoPrint 1.11.2 ステッ...

CVE-2026-94489

A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote...

CVE-2026-94490

A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument command results in os command injection. It is possible to...

CVE-2026-94490 OctoPrint Command API system.py executeSystemCommand os command injection

A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument command results in os command injection. It is possible to...

CVE-2026-94490 OctoPrint Command API system.py executeSystemCommand os command injection

A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument command results in os command injection. It is possible to...

EUVD-2026-84249

A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument command results in os command injection. It is possible to...

CVE-2026-94490

CVE-2026-94490 affects OctoPrint 1.0.0 , specifically the executeSystemCommand function in src/octoprint/server/api/system.py (the Command API component). The vulnerability is an OS command injection triggered by manipulating the command argument. The attack can be initiated remotely but requires...

PT-2026-96321

Name of the Vulnerable Software and Affected Versions OctoPrint version 1.0.0 Description An OS command injection flaw exists in the Command API component within the executeSystemCommand function of the src/octoprint/server/api/system.py file. A remote attacker can exploit this by manipulating th...

CVE-2026-94490: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument command results in os command injection. It is possible to...

CVE-2026-94489: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote...

CVE-2026-94489

A path traversal vulnerability in OctoPrint 1.0.0 affects the _validate function in src/octoprint/server/api/files.py (File Download API). Manipulation of the filename argument allows a remote attacker with low privileges to traverse directories, resulting in low confidentiality impact . The expl...

CVE-2026-94489 OctoPrint File Download API files.py _validate path traversal

A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote...

CVE-2026-94489 OctoPrint File Download API files.py _validate path traversal

A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote...

PT-2026-96320

Name of the Vulnerable Software and Affected Versions OctoPrint version 1.0.0 Description A path traversal issue exists in the File Download API component within the validate function of the src/octoprint/server/api/files.py file. A remote attacker can manipulate the filename argument to access...

CVE-2026-54134

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...

CVE-2026-35163

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML...

CVE-2026-54134 OctoPrint: File exfiltration possible via query parameters on upload endpoints

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...

CVE-2026-54134

OctoPrint (web interface for 3D printers) versions prior to 1.11.8 and 2.0.0rc3 are vulnerable to file exfiltration via parser differentials between its custom Tornado upload handler and Flask/Werkzeug. An attacker with FILE_UPLOAD permission can inject reserved internal form fields through query...

CVE-2026-54134 OctoPrint: File exfiltration possible via query parameters on upload endpoints

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...

EUVD-2026-64044

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...