CVE-2026-54134

HighCVSS 7.0

Published: 21/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 22/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

OctoPrint before versions 1.11.8 and 2.0.0rc3 has a parsing discrepancy between its custom Tornado upload handler and Flask/Werkzeug, allowing an attacker with FILE_UPLOAD permission to inject reserved internal upload fields via query parameters or parser differentials. Affected endpoints include /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file.

Risk Assessment

An attacker can make OctoPrint treat an arbitrary host file as a temporary upload, move it into a downloadable directory, disclose configuration secrets or other readable files, and remove runtime files affecting later restarts.

Recommendation

Upgrade OctoPrint to version 1.11.8 or 2.0.0rc3, which include the fix.

Other vulnerabilities in OctoPrint

CVE-2026-35163Medium
OctoPrint prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim's OctoPrint session.

Original NVD description (English source)

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILE_UPLOAD permission to inject reserved internal upload fields through query parameters or parser differentials despite the earlier GHSA-m9jh-jf9h-x3h2 fix. The affected endpoints are /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file. An attacker can make OctoPrint treat an arbitrary host file as a temporary upload, move it into a downloadable upload directory, disclose configuration secrets or other readable files, and remove runtime files in a way that can affect a later restart. This issue is fixed in versions 1.11.8 and 2.0.0rc3.