Executive brief
OctoPrint, a popular web interface for 3D printers, contains a vulnerability that allows users with file upload permissions to access sensitive files on the host system. An attacker could use this to steal configuration secrets or delete critical system files, potentially leading to a complete service outage. While an account with specific permissions is required, the flaw could result in the exposure of private data or loss of printer control.
Technical details
OctoPrint is vulnerable to an interpretation conflict and external control of file paths. The application uses a Tornado-based upload handler that sits in front of a Flask web application. The handler adds internal reserved form fields to requests to indicate temporary file locations. An attacker can bypass previous fixes by providing these reserved fields via query parameters or through parser differentials between Tornado and Werkzeug (Flask). This allows an attacker to trick the server into treating an existing system file as a new upload, moving it into a publicly accessible directory for download or causing its deletion. The vulnerability affects multiple endpoints including /api/files and /api/languages. It is patched in versions 1.11.8 and 2.0.0rc3.
Affected products
- OctoPrint OctoPrint <= 1.11.7, 2.0.0rc1, 2.0.0rc2
Timeline
- 2026-06-04: disclosed: Report received by vendor
- 2026-06-23: patched: Fix released in 1.11.8 and 2.0.0rc3
- 2026-06-23: advisory