OctoPrint vulnerabilities

A security flaw in OctoPrint 1.0.0 in the executeSystemCommand function of src/octoprint/server/api/system.py (Command API) allows OS command injection via the command argument. The attack can be initiated remotely, and the exploit is publicly available.

A vulnerability in OctoPrint 1.0.0 in the _validate function of src/octoprint/server/api/files.py (File Download API) allows path traversal via the filename argument. The attack can be performed remotely, and the exploit is publicly available.

OctoPrint before versions 1.11.8 and 2.0.0rc3 has a parsing discrepancy between its custom Tornado upload handler and Flask/Werkzeug, allowing an attacker with FILE_UPLOAD permission to inject reserved internal upload fields via query parameters or parser differentials. Affected endpoints include /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file.

OctoPrint prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim's OctoPrint session.