Is CVE-2026-54134 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54134 being exploited in the wild.

How severe is CVE-2026-54134?

High severity, with a CVSS score of 4, published 21 August 2026.

Which products and versions are affected?

OctoPrint (PyPI) ECOSYSTEM:introduced=0,fixed=1.11.8, ECOSYSTEM:introduced=0,fixed=1.11.8,introduced=2.0.0rc1,fixed=2.0.0rc3.

Is there a fix for CVE-2026-54134?

Yes. OctoPrint (PyPI): upgrade to 1.11.8, 2.0.0rc3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54134 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-54134?

Check whether you run OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54134: OctoPrint file exfiltration via query parameters in upload endpoints

CVE-2026-54134 · Severity: high · CVSS 4 · Published 2026-08-21

OctoPrint, a popular web interface for 3D printers, contains a vulnerability that allows users with file upload permissions to access sensitive files on the host system. An attacker could use this to steal configuration secrets or delete critical system files, potentially leading to a complete service outage. While an account with specific permissions is required, the flaw could result in the exposure of private data or loss of printer control.

Technologies: OctoPrint (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54134 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54134 being exploited in the wild.
How severe is CVE-2026-54134?: High severity, with a CVSS score of 4, published 21 August 2026.
Which products and versions are affected?: OctoPrint (PyPI) ECOSYSTEM:introduced=0,fixed=1.11.8, ECOSYSTEM:introduced=0,fixed=1.11.8,introduced=2.0.0rc1,fixed=2.0.0rc3.
Is there a fix for CVE-2026-54134?: Yes. OctoPrint (PyPI): upgrade to 1.11.8, 2.0.0rc3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54134 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-54134?: Check whether you run OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

OctoPrint (PyPI): upgrade to 1.11.8, 2.0.0rc3 or later
```
pip install "OctoPrint>=2.0.0rc3"
```

Technical details

OctoPrint is vulnerable to an interpretation conflict and external control of file paths. The application uses a Tornado-based upload handler that sits in front of a Flask web application. The handler adds internal reserved form fields to requests to indicate temporary file locations. An attacker can bypass previous fixes by providing these reserved fields via query parameters or through parser differentials between Tornado and Werkzeug (Flask). This allows an attacker to trick the server into treating an existing system file as a new upload, moving it into a publicly accessible directory for download or causing its deletion. The vulnerability affects multiple endpoints including /api/files and /api/languages. It is patched in versions 1.11.8 and 2.0.0rc3.

Affected products

OctoPrint OctoPrint <= 1.11.7, 2.0.0rc1, 2.0.0rc2

Identifiers

CVE-2026-54134
GHSA-j4h9-pm27-4rfw
PYSEC-2026-2687

Timeline

2026-06-04: disclosed: Report received by vendor
2026-06-23: patched: Fix released in 1.11.8 and 2.0.0rc3
2026-06-23: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.