OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
Impact
OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered.
If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact.
Patches
The vulnerability will be patched in version 1.11.3.
Workaround
Until the patch has been applied, OctoPrint administrators who have event handlers configured that include any kind of filename based placeholders (i.e. {__filename}, {__filepath}, {filename}, {path}, etc -- refer to the events documentation for a full list) should disable those by setting their enabled property to False or unchecking the "Enabled" checkbox in the GUI based Event Manager.
Alternatively, OctoPrint administrators should set feature.enforceReallyUniversalFilenames to true in config.yaml and restart OctoPrint, then vet the existing uploads and make sure to delete any suspicious looking files (e.g. those that contain a ; in their name followed by a command).
As always, OctoPrint administrators are advised to not expose OctoPrint on hostile networks like the public internet, and to vet who has access to their instance.
Credits
This vulnerability was discovered and responsibly disclosed to OctoPrint by @prabhatverma47.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | octoprint | < 1.11.3 | 1.11.3 |
Referencias
- https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-49mj-x8jp-qvfc
- https://nvd.nist.gov/vuln/detail/CVE-2025-58180
- https://github.com/OctoPrint/OctoPrint/commit/be4201ef58d9a7c03593252398c16eada90a258b
- https://github.com/OctoPrint/OctoPrint/commit/c3a940962f4658a8e035a00388781b1cbd768841
- https://github.com/OctoPrint/OctoPrint
- https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.3
- https://pypi.org/project/octoprint
- https://github.com/advisories/GHSA-49mj-x8jp-qvfc
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-78- Plataforma
- Python (PyPI)
- Paquete
octoprint- Publicada
- 09.09.2025
- Actualizado
- 11.10.2026 13:19
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-1712 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-49mj-x8jp-qvfc - CC BY 4.0
Historial de vulnerabilidades: octoprint
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 24
- Primera → última
- 05.2021 06.2026
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 8
- Media 13
- Baja 2
Divulgaciones por año
- 2021: 2
- 2022: 8
- 2023: 1
- 2024: 5
- 2025: 5
- 2026: 3
-
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.