Octoprint vulnerabilities

Products

• Octoprint 27
• Octoprint/octoprint 8

Newest

• octoprint OctoPrint Flask Secret Key hard-coded key CVE-2014-125135 6.9 MediumOctober 26, 2026
• octoprint OctoPrint API Key settings.py getSettings information disclosure CVE-2013-10077 6.9 MediumOctober 26, 2026
• octoprint OctoPrint: File exfiltration possible via query parameters on upload endpoints CVE-2026-54134 Fix available 7.0 HighJune 23, 2026
• octoprint OctoPrint: XSS in Suppressed Command Notifications CVE-2026-35163 Fix available 4.6 MediumJune 23, 2026
• octoprint OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication CVE-2026-23892 Fix available 6.0 MediumJanuary 27, 2026
• octoprint OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts CVE-2025-64187 Fix available 4.6 MediumNovember 4, 2025
• octoprint OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload CVE-2025-58180 Public exploitFix available EPSS 22.1% 7.5 HighSeptember 9, 2025
• octoprint OctoPrint Vulnerable to Denial of Service through malformed HTTP request CVE-2025-48879 Fix available 6.5 MediumJune 10, 2025
• octoprint OctoPrint vulnerable to possible file extraction via upload endpoints CVE-2025-48067 Fix available 5.4 MediumJune 10, 2025
• octoprint OctoPrint Authenticated Reverse Proxy Page Authentication Bypass CVE-2025-32788 Fix available 4.3 MediumApril 22, 2025
• octoprint API key access in settings without reauthentication in OctoPrint CVE-2024-51493 Fix available 5.3 MediumNovember 5, 2024
• octoprint Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint CVE-2024-49377 Fix available 5.5 MediumNovember 5, 2024
• octoprint OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled CVE-2024-32977 Fix available 7.1 HighMay 14, 2024
• octoprint OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings CVE-2024-28237 Fix available 4.0 MediumMarch 18, 2024
• octoprint OctoPrint Unverified Password Change via Access Control Settings CVE-2024-23637 Fix available 4.2 MediumJanuary 31, 2024
• octoprint Improper Neutralization of Special Elements Used in a Template Engine in OctoPrint CVE-2023-41047 Fix available 6.2 MediumOctober 9, 2023
• octoprint, octoprint octoprint/octoprint +1 more Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint CVE-2022-3607 Fix available 6.0 MediumOctober 19, 2022
• octoprint, octoprint octoprint/octoprint +1 more Improper Privilege Management in octoprint/octoprint CVE-2022-3068 Fix available 5.3 MediumSeptember 21, 2022
• octoprint, octoprint octoprint/octoprint +1 more Insufficient Session Expiration in octoprint/octoprint CVE-2022-2888 Fix available 4.4 MediumSeptember 21, 2022
• octoprint, octoprint octoprint/octoprint +1 more Unrestricted Upload of File with Dangerous Type in octoprint/octoprint CVE-2022-2872 Fix available 3.7 LowSeptember 21, 2022
• octoprint, octoprint octoprint/octoprint +1 more Unverified Password Change in octoprint/octoprint CVE-2022-2930 Fix available 5.3 MediumAugust 22, 2022
• octoprint, octoprint octoprint/octoprint +1 more Authentication Bypass by Primary Weakness in octoprint/octoprint CVE-2022-2822 3.7 LowAugust 15, 2022
• octoprint, octoprint octoprint/octoprint +1 more Cross-site Scripting (XSS) - Generic in octoprint/octoprint CVE-2022-1432 Fix available 7.5 HighMay 18, 2022
• octoprint, octoprint octoprint/octoprint +1 more Cross-site Scripting (XSS) - DOM in octoprint/octoprint CVE-2022-1430 Fix available 7.5 HighMay 18, 2022
• octoprint OctoPrint API Error Messages vulnerable to XSS CVE-2021-32561 Fix available 6.1 MediumMay 11, 2021
• octoprint OctoPrint Incorrect Access Control CVE-2021-32560 Fix available 6.5 MediumMay 11, 2021
• octoprint ** DISPUTED ** OctoPrint through 1.3.9 allows remote attackers to obtain sensitive information or... CVE-2018-16710 Disputed 9.1 CriticalSeptember 7, 2018