Executive brief
OctoPrint is a web-based control interface for 3D printers. A path traversal vulnerability in the file download function allows attackers to read arbitrary files from the server by manipulating filename parameters, potentially exposing configuration files, API keys, or other sensitive data stored on the printer's control computer.
Technical details
The File Download API's _validate function in src/octoprint/server/api/files.py fails to properly sanitize the filename argument, allowing path traversal attacks via directory traversal sequences. An unauthenticated remote attacker can exploit this to access files outside the intended download directory. A fix is available from the vendor.
Affected products
- OctoPrint OctoPrint 1.0.0
Timeline
- 2026-09-22: disclosed