OctoPrint CVE-2026-54134
HIGH
GHSA-j4h9-pm27-4rfw
Severity by source
Network-reachable web endpoints (AV:N), reliable parser-differential exploit (AC:L), requires an authenticated FILE_UPLOAD user (PR:L), high confidentiality from secret exfiltration with limited integrity/availability impact.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
2DescriptionCVE.org
Impact
OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the FILE_UPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability was already reported as GHSA-m9jh-jf9h-x3h2/CVE-2025-48067 but the fix provided in OctoPrint 1.11.2 turned out to be incomplete.
The primary risk lies in the potential exfiltration of secrets stored inside OctoPrint's config, or further system files. By removing important runtime files, this could also be used to impact the availability of the host after an attempted server restart. Given that the attacker requires a user account with file upload permissions, the actual impact of this should however hopefully be minimal in most cases.
Patches
The vulnerability has been patched in version 1.11.8 and 2.0.0rc3.
Details
OctoPrint's web application is implemented in Flask, but uploads are first intercepted by a custom upload handler built on Tornado that sits in front of it. The handler streams the upload to a temporary file on disk - so files larger than the available memory can be uploaded - and rewrites the request, adding internal form fields that tell Flask where to find that temporary file.
These fields are reserved and meant to be set only by the upload handler, never by the client. The previous fix from GHSA-m9jh-jf9h-x3h2/CVE-2025-48067 stripped them from the request received from the client when they were sent as multipart form fields, yet they could still reach Flask through other channels: as plain query parameters, or - since the Tornado handler and Flask did not parse requests identically - smuggled in via several "parser differentials" that looked harmless to the handler while Flask still saw the injected fields. Any of these let an attacker make OctoPrint treat an arbitrary file on the host as a freshly uploaded one and move it into the upload folder.
The following endpoints in OctoPrint are affected:
/api/files/{local|sdcard}/api/languages/plugin/backup/restore/plugin/pluginmanager/upload_file
Further upload endpoints in third party plugins might be affected too.
The fix rejects requests carrying any of the reserved fields, aligns the Tornado handler's request parsing with Flask's (Werkzeug) to avoid any differential parsing, and re-validates the request rewritten by Tornado before forwarding it to Flask.
Credits
This vulnerability was discovered and responsibly disclosed to OctoPrint by Koh Jun Sheng and Jacopo Tediosi.
Timeline
2026-06-04: Report received 2026-06-04: Report acknowledged 2026-06-08: Report verified 2026-06-17: Fix ready for 1.11.x 2026-06-22: Fix ported to 2.0.0 2026-06-23: Fix released with 1.11.8 and 2.0.0rc3
AnalysisAI
Arbitrary file exfiltration in OctoPrint versions through 1.11.7 and 2.0.0rc1-rc2 allows authenticated users with the FILE_UPLOAD permission to move any host file readable by the OctoPrint process into the upload folder, where it can then be downloaded. This is an incomplete-fix recurrence of CVE-2025-48067; reserved internal form fields can still be smuggled to Flask via query parameters or Tornado/Werkzeug parser differentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid OctoPrint user account on a vulnerable instance (<=1.11.7, or 2.0.0rc1/rc2) that has been granted the FILE_UPLOAD permission, and network reachability to one of the affected upload endpoints (/api/files/local, /api/files/sdcard, /api/languages, /plugin/backup/restore, /plugin/pluginmanager/upload_file, or a vulnerable third-party plugin upload endpoint). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS or EPSS score is provided in the input and the CVE is not on the CISA KEV list, so quantitative risk signals are absent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privilege OctoPrint account that holds FILE_UPLOAD (for example a shared makerspace user or a compromised low-tier account) sends a crafted POST to /api/files/local with the reserved internal form fields supplied as query-string parameters pointing at /home/pi/.octoprint/config.yaml. OctoPrint's Tornado front-end fails to strip them, Flask treats config.yaml as a freshly uploaded file and moves it into the uploads directory, and the attacker then downloads it via the normal file listing API to harvest the API key and stored credentials. … |
| Remediation | Upgrade to OctoPrint 1.11.8 (stable users) or 2.0.0rc3 (pre-release users) as published in advisory GHSA-j4h9-pm27-4rfw at https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-j4h9-pm27-4rfw; the fix rejects requests carrying the reserved internal fields, aligns Tornado's parsing with Werkzeug, and re-validates the rewritten request before forwarding to Flask. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all OctoPrint deployments and current version numbers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today