---
id: CVE-2025-58180
aliases:
  - GHSA-49mj-x8jp-qvfc
  - PYSEC-2026-1712
title: OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
summary: OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: octoprint
product: octoprint
ecosystem: pip
affected:
  - octoprint < 1.11.3
patched:
  - octoprint 1.11.3
published: '2025-09-09'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-49mj-x8jp-qvfc'
references:
  - url: >-
      https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-49mj-x8jp-qvfc
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-58180'
  - url: >-
      https://github.com/OctoPrint/OctoPrint/commit/be4201ef58d9a7c03593252398c16eada90a258b
  - url: >-
      https://github.com/OctoPrint/OctoPrint/commit/c3a940962f4658a8e035a00388781b1cbd768841
  - url: 'https://github.com/OctoPrint/OctoPrint'
  - url: 'https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.3'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.20621
epssPercentile: 0.97438
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:45.453Z'
exploits:
  exploitdb: true
  github: 1
  githubRepos:
    - 'https://github.com/prabhatverma47/CVE-2025-58180'
  checkedAt: '2026-09-26T09:05:34.146Z'
---

## Overview

### Impact

OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an **authenticated** attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered.

If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact.

### Patches

The vulnerability will be patched in version 1.11.3.

### Workaround

Until the patch has been applied, OctoPrint administrators who have event handlers configured that include any kind of filename based placeholders (i.e. `{__filename}`, `{__filepath}`, `{filename}`, `{path}`, etc -- refer to [the events documentation](https://docs.octoprint.org/en/master/events/index.html#placeholders) for a full list) should disable those by setting their `enabled` property to `False` or unchecking the "Enabled" checkbox in the GUI based Event Manager.

Alternatively, OctoPrint administrators should set `feature.enforceReallyUniversalFilenames` to `true` in `config.yaml` and restart OctoPrint, then vet the existing uploads and make sure to delete any suspicious looking files (e.g. those that contain a `;` in their name followed by a command).

As always, OctoPrint administrators are advised to not expose OctoPrint on hostile networks like the public internet, and to vet who has access to their instance.

### Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by @prabhatverma47.

## Affected packages

- `octoprint < 1.11.3`

## Remediation

Upgrade to a patched release:

- `octoprint 1.11.3`