CVE-2025-58180High· 8.8▾ MidnightPoC availableOctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 48.4 · likelihood 4.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
19%
19% → 21%
Exploit-DB · 1 GitHub repo (last check)
OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered.
If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact.
The vulnerability will be patched in version 1.11.3.
Until the patch has been applied, OctoPrint administrators who have event handlers configured that include any kind of filename based placeholders (i.e. {__filename}, {__filepath}, {filename}, {path}, etc -- refer to the events documentation for a full list) should disable those by setting their enabled property to False or unchecking the "Enabled" checkbox in the GUI based Event Manager.
Alternatively, OctoPrint administrators should set feature.enforceReallyUniversalFilenames to true in config.yaml and restart OctoPrint, then vet the existing uploads and make sure to delete any suspicious looking files (e.g. those that contain a ; in their name followed by a command).
As always, OctoPrint administrators are advised to not expose OctoPrint on hostile networks like the public internet, and to vet who has access to their instance.
This vulnerability was discovered and responsibly disclosed to OctoPrint by @prabhatverma47.
octoprint < 1.11.3Upgrade to a patched release:
octoprint 1.11.3Connected by shared product, vendor, weakness, or advisory.
CVE-2024-23637Medium· 4.2OctoPrint Unverified Password Change via Access Control Settings
CVE-2026-23892Medium· 5.9OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
CVE-2025-48067Medium· 5.4OctoPrint vulnerable to possible file extraction via upload endpoints
CVE-2025-64187MediumOctoPrint vulnerable to XSS in Action Commands Notification and Prompt
CVE-2025-48879Medium· 6.5OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint
CVE-2022-2822Low· 3.7OctoPrint does not have rate limiting on the login page