octoprint vulnerabilities
CVEs whose affected-version data names the octoprint package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
11 CVEsRSS
CVE-2026-94490Medium· 4.7A security flaw has been discovered in OctoPrint 1.0.0
A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument co…
CVE-2026-94489Medium· 4.3A vulnerability was identified in OctoPrint 1.0.0
A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function _validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename lead…
CVE-2026-35163MediumOctoPrint provides a web interface for controlling consumer 3D printers
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/…
CVE-2026-54134HighOctoPrint has possible file exfiltration via query parameters on upload endpoints
OctoPrint has possible file exfiltration via query parameters on upload endpoints
CVE-2026-23892Medium· 5.9OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
CVE-2025-64187MediumOctoPrint vulnerable to XSS in Action Commands Notification and Prompt
OctoPrint vulnerable to XSS in Action Commands Notification and Prompt
CVE-2025-58180High· 8.8PoCOctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
CVE-2025-48067Medium· 5.4OctoPrint vulnerable to possible file extraction via upload endpoints
OctoPrint vulnerable to possible file extraction via upload endpoints
CVE-2025-48879Medium· 6.5OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint
OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint
CVE-2024-23637Medium· 4.2OctoPrint Unverified Password Change via Access Control Settings
OctoPrint Unverified Password Change via Access Control Settings
CVE-2022-2822Low· 3.7OctoPrint does not have rate limiting on the login page
OctoPrint does not have rate limiting on the login page