OctoPrint has 9 CVEs on record between 2022 and 2026. 1 was published in the last 90 days. The median CVSS is 5.7 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.7
- Publish → KEV
- —
- Last 90 days
- 1 prev 1
Worst active — by depth score
CVE-2025-58180High· 8.8OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload65CVE-2026-54134HighOctoPrint has possible file exfiltration via query parameters on upload endpoints41CVE-2025-48879Medium· 6.5OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint36CVE-2026-23892Medium· 5.9OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication33CVE-2025-48067Medium· 5.4OctoPrint vulnerable to possible file extraction via upload endpoints30
OctoPrint vulnerabilities
CVEs affecting OctoPrint, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-35163MediumOctoPrint provides a web interface for controlling consumer 3D printers
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/…
CVE-2026-54134HighOctoPrint has possible file exfiltration via query parameters on upload endpoints
OctoPrint has possible file exfiltration via query parameters on upload endpoints
CVE-2026-23892Medium· 5.9OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
CVE-2025-64187MediumOctoPrint vulnerable to XSS in Action Commands Notification and Prompt
OctoPrint vulnerable to XSS in Action Commands Notification and Prompt
CVE-2025-58180High· 8.8PoCOctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
CVE-2025-48067Medium· 5.4OctoPrint vulnerable to possible file extraction via upload endpoints
OctoPrint vulnerable to possible file extraction via upload endpoints
CVE-2025-48879Medium· 6.5OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint
OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint
CVE-2024-23637Medium· 4.2OctoPrint Unverified Password Change via Access Control Settings
OctoPrint Unverified Password Change via Access Control Settings
CVE-2022-2822Low· 3.7OctoPrint does not have rate limiting on the login page
OctoPrint does not have rate limiting on the login page