CVE-2026-54134

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...

CVE-2026-54134

OctoPrint (web interface for 3D printers) versions prior to 1.11.8 and 2.0.0rc3 are vulnerable to file exfiltration via parser differentials between its custom Tornado upload handler and Flask/Werkzeug. An attacker with FILE_UPLOAD permission can inject reserved internal form fields through query...

CVE-2026-54134 OctoPrint: File exfiltration possible via query parameters on upload endpoints

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...