Executive brief
OctoPrint is a web interface for 3D printer control. A flaw in the Command API allows remote attackers to inject arbitrary operating system commands by manipulating the command argument, potentially leading to full system compromise of the machine running OctoPrint.
Technical details
The executeSystemCommand function in src/octoprint/server/api/system.py fails to properly sanitize the command parameter, allowing OS command injection. The vulnerability is remotely exploitable without authentication and has been publicly disclosed, though no exploitation in the wild has been confirmed. Vendor has not responded to disclosure attempts.
Affected products
- OctoPrint OctoPrint 1.0.0
Timeline
- 2026-09-22: disclosed
- other: Public exploit released