OctoPrint XSS and File Exfiltration Vulnerabilities (CVE-2026-35163/CVE-2026-54134)

Vulnerability Summary Vulnerability Overview 1. XSS in Suppressed Command Notifications - Severity: Moderate (4.6) - Description: OctoPrint versions 1.11.7 and earlier, as well as 2.0.0rc1 and 2.0.0rc2, contain a vulnerability that allows attackers to inject arbitrary HTML and JavaScript into suppressed command notification pop-ups. Attackers can trick victims into printing specially crafted files, thereby executing malicious code on the printer, extracting sensitive configuration information, or performing other actions as the targeted user. - CVE: CVE-2026-35163 2. File exfiltration possible via further parameter injection on upload endpoints - Severity: High (7.0) - Description: OctoPrint versions 1.11.7 and earlier, as well as 2.0.0rc1 and 2.0.0rc2, contain a vulnerability that allows attackers with permissions to exfiltrate files from the OctoPrint host. Attackers can achieve this by moving files to the upload folder and downloading them. This vulnerability was previously reported in GHSA-m9jh-j8h-x3h2/CVE-2025-48067, but the patch provided in OctoPrint 1.11.2 was incomplete. - Primary Risks: Potential secret exfiltration, including OctoPrint configuration or system files. Host availability may be impacted by deleting critical runtime files. - CVE: CVE-2026-54134 Impact Scope XSS in Suppressed Command Notifications: OctoPrint versions 1.11.7 and earlier, as well as 2.0.0rc1 and 2.0.0rc2. File exfiltration possible via further parameter injection on upload endpoints: OctoPrint versions 1.11.7 and earlier, as well as 2.0.0rc1 and 2.0.0rc2. Remediation XSS in Suppressed Command Notifications: Refer to the GitHub Security Advisory and CVE-2026-35163. File exfiltration possible via further parameter injection on upload endpoints: Refer to the GitHub Security Advisory and CVE-2026-54134. POC Code or Exploit Code No specific POC code or exploit code is provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

OctoPrint XSS and File Exfiltration Vulnerabilities (CVE-2026-35163/CVE-2026-54134)

More from this source