CVE-2025-58180

CVE-2025-58180 RCE in OctoPrint via Unsanitized Filename in File Upload In OctoPrint version =1.11.2, an attacker with file upload access e.g., valid API key or session can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote...

GHSA-P623-MXF7-QXJM OctoPrint: Stored XSS via saved connection parameters

Impact OctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default port or baudrate setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a connect request. Patches The vulnerability is patched...

EUVD-2026-120120

OctoPrint: Stored XSS via saved connection parameters...

OctoPrint: Stored XSS via saved connection parameters

Impact OctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default port or baudrate setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a connect request. Patches The vulnerability is patched...

CVE-2026-123364

OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in...

CVE-2026-123364

OctoPrint versions 2.0.0rc1 through 2.0.0rc7 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. An authenticated user can submit a crafted default port or baudrate via a connect request to the bundled Serial Connector plugin. The system persists these values in printerConnection...

CVE-2026-123364 OctoPrint: Stored XSS via saved connection parameters

OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in...

CVE-2026-123364

OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in...

CVE-2026-123364 OctoPrint: Stored XSS via saved connection parameters

OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in...

CVE-2026-123364: OctoPrint: OctoPrint provides a web interface for controlling consumer 3D printers

OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in...

PT-2026-140455

Name of the Vulnerable Software and Affected Versions OctoPrint versions 2.0.0rc1 through 2.0.0rc6 Description An authenticated user can provide a crafted default port or baudrate via a connect request to the bundled Serial Connector plugin. The software stores these values in...

CVE-2014-125135

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address...

CVE-2014-125135 OctoPrint Flask Secret Key hard-coded key

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address...

CVE-2014-125135

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address...

EUVD-2014-9832

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address...

CVE-2014-125135

OctoPrint versions 1.0.0 and 1.1.0 are vulnerable to a remote attack due to a hard-coded cryptographic key within the Flask Secret Key Handler component. This vulnerability, identified as CWE-321 and CWE-320 , allows for the use of a static key for cryptographic operations. Remediation is availab...

CVE-2014-125135 OctoPrint Flask Secret Key hard-coded key

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address...

CVE-2013-10077

A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been mad...

CVE-2013-10077 OctoPrint API Key settings.py getSettings information disclosure

A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been mad...

CVE-2013-10077

A weakness in OctoPrint 1.0.0 allows for information disclosure via the getSettings function in src/octoprint/server/ajax/settings.py within the API Key Handler component. This vulnerability stems from a lack of access control in the 2013 release, where the endpoint was part of the first-run setu...