CVE-2026-94489
MediumCVSS 4.3Summary
A vulnerability in OctoPrint 1.0.0 in the _validate function of src/octoprint/server/api/files.py (File Download API) allows path traversal via the filename argument. The attack can be performed remotely, and the exploit is publicly available.
Risk Assessment
The risk includes unauthorized access to files outside the intended directory, potentially exposing sensitive data or system configuration.
Recommendation
Update OctoPrint to a patched version and implement server-side validation and sanitization of file paths.
Other vulnerabilities in OctoPrint
See all- CVE-2026-94490Medium
A security flaw in OctoPrint 1.0.0 in the executeSystemCommand function of src/octoprint/server/api/system.py (Command API) allows OS command injection via the command argument. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-54134High
OctoPrint before versions 1.11.8 and 2.0.0rc3 has a parsing discrepancy between its custom Tornado upload handler and Flask/Werkzeug, allowing an attacker with FILE_UPLOAD permission to inject reserved internal upload fields via query parameters or parser differentials. Affected endpoints include /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file.
- CVE-2026-35163Medium
OctoPrint prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim's OctoPrint session.
Original NVD description (English source)
A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function _validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.