531 matches found
CVE-2025-58180
CVE-2025-58180 RCE in OctoPrint via Unsanitized Filename in File Upload In OctoPrint version =1.11.2, an attacker with file upload access e.g., valid API key or session can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote...
EUVD-2026-84248
A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote...
CVE-2026-94489
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The exact code first shipped in 1.6.0, does not exist in the cited 1.0.0, and in every version where i...
CVE-2026-94490
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: In the versions that have this feature, they are an admin-gated, admin-defined, by-design shell-comman...
CVE-2026-94490
A security flaw exists in OctoPrint version 1.0.0 within the Command API component. Specifically, the executeSystemCommand() function in the file src/octoprint/server/api/system.py fails to properly neutralize special elements, leading to an OS command injection vulnerability. A remote attacker c...
EUVD-2026-84249
A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument command results in os command injection. It is possible to...
CVE-2026-94490
...
CVE-2026-94489: Undefined Security Weakness
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The exact code first shipped in 1.6.0, does not exist in the cited 1.0.0, and in every version where i...
CVE-2026-94490: Undefined Security Weakness
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: In the versions that have this feature, they are an admin-gated, admin-defined, by-design shell-comman...
PT-2026-96321
Name of the Vulnerable Software and Affected Versions OctoPrint version 1.0.0 Description An OS command injection flaw exists in the Command API component within the executeSystemCommand function of the src/octoprint/server/api/system.py file. A remote attacker can exploit this by manipulating th...
CVE-2026-94489
...
CVE-2026-94489
A path traversal vulnerability exists in OctoPrint version 1.0.0 within the File Download API component. Specifically, the _validate function in src/octoprint/server/api/files.py fails to properly sanitize the filename argument, allowing a remote attacker to manipulate the path and access files o...
PT-2026-96320
Name of the Vulnerable Software and Affected Versions OctoPrint version 1.0.0 Description A path traversal issue exists in the File Download API component within the validate function of the src/octoprint/server/api/files.py file. A remote attacker can manipulate the filename argument to access...
CVE-2026-54134
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...
CVE-2026-35163
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML...
CVE-2026-54134
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...
octoprint-nanny (>=0.10.0rc1, <=0.13.4) potentially affected by CVE-2026-54134 via octoprint (>=1.8.0rc3, <=1.8.2)
octoprint PYPI version =1.8.0rc3, =0.10.0rc1, =0.13.4 Source cves: CVE-2026-54134 Source advisory: MEND:CVE-2026-54134...
EUVD-2026-64044
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...