TI-2026-39058 CVE-2026-54134 · GHSA-j4h9-pm27-4rfw
OctoPrint: File exfiltration possible via query parameters on upload endpoints
Priority LOW 39
OctoPrint provides a web interface for controlling consumer 3D printers.
Vulnerabilities
25 records
TI-2026-27317 CVE-2026-35163 · GHSA-p6qx-ghxm-389h
OctoPrint: XSS in Suppressed Command Notifications
Priority LOW 21
OctoPrint provides a web interface for controlling consumer 3D printers.
TI-2026-19250 CVE-2026-23892 · GHSA-xg4x-w2j3-57h6
OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
Priority LOW 27
OctoPrint provides a web interface for controlling consumer 3D printers.
TI-2025-39630 CVE-2025-64187 · GHSA-crvm-xjhm-9h29
OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts
Priority LOW 20
OctoPrint provides a web interface for controlling consumer 3D printers.
TI-2025-35988 CVE-2025-58180 · GHSA-49mj-x8jp-qvfc
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
Priority MEDIUM 55
OctoPrint provides a web interface for controlling consumer 3D printers.
TI-2025-31029 CVE-2025-48879 · GHSA-9wj4-8h85-pgrw
OctoPrint Vulnerable to Denial of Service through malformed HTTP request
Priority LOW 28
OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server…
TI-2025-30438 CVE-2025-48067 · GHSA-m9jh-jf9h-x3h2
OctoPrint vulnerable to possible file extraction via upload endpoints
Priority LOW 24
OctoPrint provides a web interface for controlling consumer 3D printers.
TI-2025-23825 CVE-2025-32788 · GHSA-qw93-h6pf-226x
OctoPrint Authenticated Reverse Proxy Page Authentication Bypass
Priority LOW 20
OctoPrint provides a web interface for controlling consumer 3D printers.
TI-2024-32962 CVE-2024-49377 · GHSA-xvxq-g8hw-fx4g
Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint
Priority LOW 27
OctoPrint provides a web interface for controlling consumer 3D printers.
TI-2024-34414 CVE-2024-51493 · GHSA-cc6x-8cc7-9953
API key access in settings without reauthentication in OctoPrint
Priority LOW 29
OctoPrint provides a web interface for controlling consumer 3D printers.
TI-2024-21843 CVE-2024-32977 · GHSA-2vjq-hg5w-5gm7
OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled
Priority MEDIUM 44
OctoPrint provides a web interface for controlling consumer 3D printers.
TI-2024-18796 CVE-2024-28237 · GHSA-x7mf-wrh9-r76c
OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings
Priority MEDIUM 55
OctoPrint provides a web interface for controlling consumer 3D printers.
TI-2024-15656 CVE-2024-23637 · GHSA-5626-pw9c-hmjr
OctoPrint Unverified Password Change via Access Control Settings
Priority LOW 23
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, with…
TI-2023-21673 CVE-2023-41047 · GHSA-fwfg-vprh-97ph
Improper Neutralization of Special Elements Used in a Template Engine in OctoPrint
Priority LOW 32
OctoPrint is a web interface for 3D printers.
TI-2022-03320 CVE-2022-3607 · GHSA-rj5f-vm79-5j84
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint
Priority MEDIUM 60
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.
TI-2022-02830 CVE-2022-3068 · GHSA-2p75-q37p-f852
Improper Privilege Management in octoprint/octoprint
Priority HIGH 71
Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.
TI-2022-02678 CVE-2022-2888 · GHSA-937f-qh3w-6g87
Insufficient Session Expiration in octoprint/octoprint
Priority MEDIUM 54
If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.
TI-2022-02664 CVE-2022-2872 · GHSA-49wm-4fp6-h59c
Unrestricted Upload of File with Dangerous Type in octoprint/octoprint
Priority MEDIUM 58
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
TI-2022-02710 CVE-2022-2930 · GHSA-39gf-864w-pxw4
Unverified Password Change in octoprint/octoprint
Priority LOW 34
Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.
TI-2022-02616 CVE-2022-2822 · GHSA-5w5x-q9p5-9qg3
Authentication Bypass by Primary Weakness in octoprint/octoprint
Priority LOW 35
An attacker can freely brute force username and password and can takeover any account.
TI-2022-01313 CVE-2022-1432 · GHSA-h8pc-j334-jjhm
Cross-site Scripting (XSS) - Generic in octoprint/octoprint
Priority LOW 31
Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0.
TI-2022-01311 CVE-2022-1430 · GHSA-x7r7-wmj8-vv5g
Cross-site Scripting (XSS) - DOM in octoprint/octoprint
Priority LOW 36
Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0.
TI-2021-12235 CVE-2021-32561 · GHSA-vcx4-fpmp-mvv6
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.
Priority LOW 30
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.
TI-2021-12234 CVE-2021-32560 · GHSA-x9rq-fjp5-qgm9
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it…
Priority LOW 32
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.
TI-2018-11961 CVE-2018-16710 · GHSA-pjx7-3rv2-9x45
OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause…
Priority MEDIUM 43
OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests on port 8081.