Advisory details:
pypa / octoprint/PYSEC-2026-1712
| Advisory ID | pypa/octoprint/PYSEC-2026-1712 |
| Aliases |
CVE-2025-58180
GHSA-49mj-x8jp-qvfc PYSEC-2026-1712 |
| Summary | OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload ### Impact OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an **authenticated** attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered. If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact. ### Patches The vulnerability will be patched in version 1.11.3. ### Workaround Until the patch has been applied, OctoPrint administrators who have event handlers configured that include any kind of filename based placeholders (i.e. `{__filename}`, `{__filepath}`, `{filename}`, `{path}`, etc -- refer to [the events documentation](https://docs.octoprint.org/en/master/events/index.html#placeholders) for a full list) should disable those by setting their `enabled` property to `False` or unchecking the "Enabled" checkbox in the GUI based Event Manager. Alternatively, OctoPrint administrators should set `feature.enforceReallyUniversalFilenames` to `true` in `config.yaml` and restart OctoPrint, then vet the existing uploads and make sure to delete any suspicious looking files (e.g. those that contain a `;` in their name followed by a command). As always, OctoPrint administrators are advised to not expose OctoPrint on hostile networks like the public internet, and to vet who has access to their instance. ### Credits This vulnerability was discovered and responsibly disclosed to OctoPrint by @prabhatverma47. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 7.9 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 8.8 | https://github.com/pypa/advisory-database/blob/main/vulns/octoprint/PYSEC-2026-1712.yaml |
| cvssv4 | 7.5 | https://github.com/pypa/advisory-database/blob/main/vulns/octoprint/PYSEC-2026-1712.yaml |
| Data source | Exploit-DB |
|---|---|
| Date added | Feb. 4, 2026 |
| Description | OctoPrint 1.11.2 - File Upload |
| Ransomware campaign use | Unknown |
| Source publication date | Feb. 4, 2026 |
| Exploit type | webapps |
| Platform | multiple |
| Source update date | Feb. 4, 2026 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-09-10T13:59:03Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/58xxx/CVE-2025-58180.json
Source Advisory: vulnrichment/CVE-2025-58180
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]