Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

OctoPrint — Vulnerabilities & Security Advisories 14

All 14 CVE vulnerabilities found in OctoPrint, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities associated with OctoPrint, a self-hosted web interface for 3D printers, focusing on various weakness types and specific security tags. It collects a comprehensive record of flaws identified in the software, spanning its operational history from early releases through the most recent disclosed incidents. Readers can utilize this resource to track the vendor's advisory timeline, understand the recurrence of specific weakness classes such as access control or code injection, and review the complete vulnerability history of the product to assess its long-term security posture. The data serves as a neutral repository for technical details, allowing developers and security professionals to analyze trends, evaluate patch effectiveness, and identify persistent architectural issues without external bias. By centralizing this information, the page facilitates a clear view of how the application has evolved in response to security threats, providing a factual baseline for risk assessment and compliance reporting. This aggregation helps stakeholders move beyond isolated incident reports to a broader understanding of the product's security lifecycle.

Vendor: OctoPrint

CVE ID Title CVSS Severity Published
CVE-2026-54134 OctoPrint: File exfiltration possible via query parameters on upload endpoints CWE-73 7.0 High 2026-08-21
CVE-2026-35163 OctoPrint: XSS in Suppressed Command Notifications CWE-80 4.6 Medium 2026-08-21
CVE-2026-23892 OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication CWE-208 5.9AI Medium AI 2026-01-27
CVE-2025-64187 OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts CWE-80 6.1 - 2025-11-07
CVE-2025-58180 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload CWE-78 8.8AI High AI 2025-09-09
CVE-2025-48879 OctoPrint Vulnerable to Denial of Service through malformed HTTP request CWE-140 6.5 Medium 2025-06-10
CVE-2025-48067 OctoPrint vulnerable to possible file extraction via upload endpoints CWE-73 5.4 Medium 2025-06-10
CVE-2025-32788 OctoPrint Authenticated Reverse Proxy Page Authentication Bypass CWE-290 4.3 Medium 2025-04-22
CVE-2024-49377 Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint CWE-79 5.5 Medium 2024-11-05
CVE-2024-51493 API key access in settings without reauthentication in OctoPrint CWE-620 5.3 Medium 2024-11-05
CVE-2024-32977 OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled CWE-290 7.1 High 2024-05-14
CVE-2024-28237 OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings CWE-79 4.0 Medium 2024-03-18
CVE-2024-23637 OctoPrint Unverified Password Change via Access Control Settings CWE-287 4.2 Medium 2024-01-31
CVE-2023-41047 Improper Neutralization of Special Elements Used in a Template Engine in OctoPrint CWE-1336 6.2 Medium 2023-10-09

All 14 known CVE vulnerabilities affecting OctoPrint with full Chinese analysis, references, and POCs where available.