Security advisories

high2026-06-23

CVE-2026-54134-OctoPrint has possible file exfiltration via query parameters on upload endpoints

GHSA-j4h9-pm27-4rfw

medium2026-06-23

CVE-2026-35163-OctoPrint has XSS in its Suppressed Command Notifications

GHSA-p6qx-ghxm-389h

medium2026-01-27

CVE-2026-23892-OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication

GHSA-xg4x-w2j3-57h6

medium2025-11-04

CVE-2025-64187-OctoPrint vulnerable to XSS in Action Commands Notification and Prompt

GHSA-crvm-xjhm-9h29

high2025-09-09

CVE-2025-58180-OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload

GHSA-49mj-x8jp-qvfc

medium2025-06-10

CVE-2025-48879-OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint

GHSA-9wj4-8h85-pgrw

medium2025-06-10

CVE-2025-48067-OctoPrint vulnerable to possible file extraction via upload endpoints

GHSA-m9jh-jf9h-x3h2

medium2025-04-22

CVE-2025-32788-OctoPrint Authenticated Reverse Proxy Page Authentication Bypass

GHSA-qw93-h6pf-226x

medium2024-11-05

CVE-2024-51493-OctoPrint has API key access in settings without reauthentication

GHSA-cc6x-8cc7-9953

medium2024-11-05

CVE-2024-49377-OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates

GHSA-xvxq-g8hw-fx4g

high2024-05-14

CVE-2024-32977-OctoPrint has an Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled

GHSA-2vjq-hg5w-5gm7

medium2024-03-18

CVE-2024-28237-XSS via the "Snapshot Test" feature in Classic Webcam plugin settings

GHSA-x7mf-wrh9-r76c

medium2024-01-31

CVE-2024-23637-OctoPrint Unverified Password Change via Access Control Settings

GHSA-5626-pw9c-hmjr

high2023-10-10

CVE-2023-41047-OctoPrint vulnerable to Improper Neutralization of Special Elements Used in a Template Engine

GHSA-fwfg-vprh-97ph

medium2022-10-19

CVE-2022-3607-OctoPrint vulnerable to Special Element Injection

GHSA-rj5f-vm79-5j84

low2022-09-22

CVE-2022-2872-OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type

GHSA-49wm-4fp6-h59c

medium2022-09-22

CVE-2022-2888-OctoPrint vulnerable to Insufficient Session Expiration.

GHSA-937f-qh3w-6g87

high2022-09-22

CVE-2022-3068-OctoPrint Improper Privilege Management vulnerability

GHSA-2p75-q37p-f852

medium2022-08-23

CVE-2022-2930-Unverified Password Change in OctoPrint

GHSA-39gf-864w-pxw4

low2022-08-16

CVE-2022-2822-OctoPrint does not have rate limiting on the login page

GHSA-5w5x-q9p5-9qg3