CVE-2022-2872
Unrestricted Upload of File with Dangerous Type in octoprint/octoprint
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Unrestricted Upload of File with Dangerous Type in octoprint/octoprint
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
- Record
CVE-2022-2872- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
EUVDEUVD-2022-0176
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
- Record
EUVD-2022-0176- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-49wm-4fp6-h59c
OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type
OctoPrint prior to version 1.8.3 is vulnerable to Unrestricted Upload of File with Dangerous Type. Due to misconfiguration in move file functionality, an attacker could easily change the file extension of an uploaded malicious file disguised as a .gcode file. Version 1.8.3 contains a patch.
- Record
GHSA-49wm-4fp6-h59c- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
NVD
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
- Record
CVE-2022-2872- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
OSV
Unrestricted Upload of File with Dangerous Type in octoprint/octoprint
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
- Record
CVE-2022-2872- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
OSVGHSA-49wm-4fp6-h59c
OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type
OctoPrint prior to version 1.8.3 is vulnerable to Unrestricted Upload of File with Dangerous Type. Due to misconfiguration in move file functionality, an attacker could easily change the file extension of an uploaded malicious file disguised as a .gcode file. Version 1.8.3 contains a patch.
- Record
GHSA-49wm-4fp6-h59c- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
OSVPYSEC-2022-286 No score
Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.
- Record
PYSEC-2022-286- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
octoprintPyPI |
before 1.8.3 | 1.8.3 |
octoprintPyPI |
before 1.8.3, plus listed versions 1.3.111.3.121.3.12rc11.3.12rc31.4.0 Show 39 moreShow less1.4.0rc11.4.0rc21.4.0rc31.4.0rc41.4.0rc51.4.0rc61.4.11.4.1rc11.4.1rc21.4.1rc31.4.1rc41.4.21.5.01.5.0rc11.5.0rc21.5.0rc31.5.11.5.21.5.31.6.01.6.0rc11.6.0rc21.6.0rc31.6.11.7.01.7.0rc11.7.0rc21.7.0rc31.7.11.7.21.7.31.8.01.8.0rc11.8.0rc21.8.0rc31.8.0rc41.8.0rc51.8.11.8.2 |
1.8.3 |
octoprintPyPI |
before 1.8.3, plus listed versions 1.3.111.3.121.3.12rc11.3.12rc31.4.0 Show 45 moreShow less1.4.0rc11.4.0rc21.4.0rc31.4.0rc41.4.0rc51.4.0rc61.4.11.4.1rc11.4.1rc21.4.1rc31.4.1rc41.4.21.5.01.5.0rc11.5.0rc21.5.0rc31.5.11.5.21.5.31.6.01.6.0rc11.6.0rc21.6.0rc31.6.11.7.01.7.0rc11.7.0rc21.7.0rc31.7.11.7.21.7.31.8.01.8.0rc11.8.0rc21.8.0rc31.8.0rc41.8.0rc51.8.11.8.21.2.181.2.18rc11.2.17rc31.2.17rc21.2.17rc11.2.16 |
1.8.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-2872 is a low vulnerability (CVSS 3.7) in Octoprint, published September 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in octoprint 1.8.3.
References
huntr.dev/bounties/b966c74d-6f3f-49fe-b40a-eaf25e362c56
github.com/octoprint/octoprint/commit/3e3c11811e216fb371a33e28412df83f9701e5b0
nvd.nist.gov/vuln/detail/CVE-2022-2872
Left out here: 23 versions. The JSON record has them.