OctoPrint Parameter Injection Leading to File Disclosure (CVE-2025-54134)

Vulnerability Overview OctoPrint versions 1.11.7 and 2.0.0rc1/2 are vulnerable to an issue that allows attackers to inject parameters through the upload endpoint, enabling the extraction of files from hosts accessible by OctoPrint. This vulnerability is reported as GHSA-j4h9-pm27-4rfw. The previous fix (GHSA-m9jh-j9h-v3x2/CVE-2025-4067) failed to fully remediate this issue in OctoPrint 1.11.2. Impact Scope Affected Versions: - OctoPrint = 2.0.0rc1, <= 2.0.0rc2 Impact: - Attackers can upload files to OctoPrint's upload folder and subsequently download them from that folder. - This may lead to the leakage of sensitive information stored in OctoPrint configuration or system files. - Host availability may be affected after an attempted server restart. - Exploitation requires the user to have file upload permissions. Remediation Fixed Versions: - OctoPrint 1.11.8 - OctoPrint 2.0.0rc3 Remediation Measures: - Fixed the issue of reserved fields being present in requests. Aligned the request parsing of the Tornado processor with Flask's parsing to avoid any discrepancies in parsing, and re-validated requests before forwarding them to Flask. Detailed Information Vulnerability Details: - OctoPrint's web application is implemented using Flask. Uploads are first intercepted by a custom upload processor that operates in front of Tornado. - The processor streams the upload to a temporary file on disk, which may be significantly larger than available memory, and then rewrites the request by adding internal form fields to allow Flask to locate the temporary file. - These fields are reserved and intended to be set only by the upload processor, not by the client. - The previous fix (GHSA-m9jh-j9h-v3x2/CVE-2025-4067) stripped these fields from the request; however, when sent as multipart form fields, they could still reach Flask via alternative channels because the Tornado processor and Flask do not parse requests in the same manner. - Attackers can exploit this discrepancy to masquerade as OctoPrint's upload files on the host and move them into the upload folder. Affected Endpoints: - - - - Other Upload Endpoints: - Other upload endpoints within third-party plugins may also be affected. Timeline 2026-06-04: Report received 2026-06-04: Report confirmed 2026-06-08: Report verified 2026-06-17: Fix ready (1.11.x) 2026-06-20: Fix ported to 2.0.0 2026-06-23: Fix released (1.11.8 and 2.0.0rc3) Credits Discovered by: Koh Jun Sheng and Jacopo Tediosi Additional Information CVSS v4 Base Metrics: - Attack Vector: Adjacent - Attack Complexity: Low - Attack Requirements: None - User Interaction: None - Confidentiality: High - Integrity: Low - Availability: None CVE ID: CVE-2025-54134 Weaknesses: - CWE-73 - CWE-436 Reporter: - Koh Jun Sheng - Jacopo Tediosi

Goal Reached Thanks to every supporter — we hit 100%!

OctoPrint Parameter Injection Leading to File Disclosure (CVE-2025-54134)

More from this source