Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

octoprint

24 known vulnerabilities (5 high, 15 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
1.11.8 (Jun 23, 2026): no advisory affects it
Newest unaffected release
1.11.8 (Jun 23, 2026), the latest release
Advisories
24 · 5 high, 15 medium, 2 low
Weekly downloads
4,674
Dependents
10
Releases
89 since 1.3.11 (Sep 4, 2019)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 24 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 24

  • OctoPrint: File exfiltration possible via query parameters on upload endpoints

    Affected: fixed in 1.11.8; from 2.0.0rc1, fixed in 2.0.0rc3; fixed in 1.11.8; from 2.0.0rc1, fixed in 2.0.0rc3.

    Fixed in 1.11.8 (released Jun 23, 2026, 59 days before disclosure) and 2.0.0rc3 (released Jun 23, 2026, 59 days before disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2026-35163Medium 4.6

    OctoPrint: XSS in Suppressed Command Notifications

    Affected: fixed in 1.11.8; from 2.0.0rc1, fixed in 2.0.0rc3; fixed in 1.11.8; from 2.0.0rc1, fixed in 2.0.0rc3.

    Fixed in 1.11.8 (released Jun 23, 2026, 59 days before disclosure) and 2.0.0rc3 (released Jun 23, 2026, 59 days before disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2026-23892Medium 6.0

    OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication

    Affected: fixed in 1.11.6.

    Fixed in 1.11.6 (released Jan 27, 2026, the day of disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2025-64187Medium 4.6

    OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts

    Affected: fixed in 1.11.4.

    Fixed in 1.11.4 (released Nov 4, 2025, 3 days before disclosure).

    The latest release, 1.11.8, is not affected.

  • OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload

    Affected: fixed in 1.11.3.

    Fixed in 1.11.3 (released Sep 9, 2025, the day of disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2025-48879Medium 6.5

    OctoPrint Vulnerable to Denial of Service through malformed HTTP request

    Affected: fixed in 1.11.2.

    Fixed in 1.11.2 (released Jun 10, 2025, the day of disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2025-48067Medium 5.4

    OctoPrint vulnerable to possible file extraction via upload endpoints

    Affected: fixed in 1.11.2.

    Fixed in 1.11.2 (released Jun 10, 2025, the day of disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2025-32788Medium 4.3

    OctoPrint Authenticated Reverse Proxy Page Authentication Bypass

    Affected: fixed in 1.11.0.

    Fixed in 1.11.0 (released Apr 22, 2025, the day of disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2024-49377Medium 5.5

    Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint

    Affected: fixed in 1.10.3.

    Fixed in 1.10.3 (released Nov 5, 2024, the day of disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2024-51493Medium 5.3

    API key access in settings without reauthentication in OctoPrint

    Affected: fixed in 1.10.3.

    Fixed in 1.10.3 (released Nov 5, 2024, the day of disclosure).

    The latest release, 1.11.8, is not affected.

  • OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled

    Affected: fixed in 1.10.1; fixed in 1.10.1.

    Fixed in 1.10.1 (released May 14, 2024, the day of disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2024-28237Medium 4.0

    OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings

    Affected: fixed in 1.10.0; fixed in 1.10.0rc3.

    Fixed in 1.10.0 (released Apr 24, 2024, 37 days after disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2024-23637Medium 4.2

    OctoPrint Unverified Password Change via Access Control Settings

    Affected: fixed in 1.10.0rc1.

    Fixed in 1.10.0rc1 (released Jan 31, 2024, the day of disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2023-41047Medium 6.2

    Improper Neutralization of Special Elements Used in a Template Engine in OctoPrint

    Affected: fixed in 1.9.3.

    Fixed in 1.9.3 (released Oct 9, 2023, the day of disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2022-3607Medium 6.0

    Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint

    Affected: fixed in 1.8.3; fixed in 1.8.3.

    Fixed in 1.8.3 (released Sep 20, 2022, 29 days before disclosure).

    The latest release, 1.11.8, is not affected.

Show all 24 advisoriesShow fewer advisories
  • CVE-2022-3068Medium 5.3

    Improper Privilege Management in octoprint/octoprint

    Affected: fixed in 1.8.3; fixed in 1.8.3.

    Fixed in 1.8.3 (released Sep 20, 2022, 1 day before disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2022-2888Medium 4.4

    Insufficient Session Expiration in octoprint/octoprint

    Affected: fixed in 1.8.3; fixed in 1.8.3.

    Fixed in 1.8.3 (released Sep 20, 2022, 1 day before disclosure).

    The latest release, 1.11.8, is not affected.

  • Unrestricted Upload of File with Dangerous Type in octoprint/octoprint

    Affected: fixed in 1.8.3; fixed in 1.8.3.

    Fixed in 1.8.3 (released Sep 20, 2022, 1 day before disclosure).

    The latest release, 1.11.8, is not affected.

  • CVE-2022-2930Medium 5.3

    Unverified Password Change in octoprint/octoprint

    Affected: fixed in 1.8.3; fixed in 1.8.3.

    Fixed in 1.8.3 (released Sep 20, 2022, 29 days after disclosure).

    The latest release, 1.11.8, is not affected.

  • Authentication Bypass by Primary Weakness in octoprint/octoprint

    Affected: through 1.7.3.

    Fixed in 1.8.0 (released May 17, 2022, 90 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.11.8, is not affected.

  • Cross-site Scripting (XSS) - Generic in octoprint/octoprint

    Affected: fixed in 1.8.0.

    Fixed in 1.8.0 (released May 17, 2022, 1 day before disclosure).

    The latest release, 1.11.8, is not affected.

  • Cross-site Scripting (XSS) - DOM in octoprint/octoprint

    Affected: fixed in 1.8.0.

    Fixed in 1.8.0 (released May 17, 2022, 1 day before disclosure).

    The latest release, 1.11.8, is not affected.

  • OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.

    Affected: fixed in 1.6.0.

    Fixed in 1.6.0 (released Apr 27, 2021, 14 days before disclosure).

    The latest release, 1.11.8, is not affected.

  • The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.

    Affected: fixed in 1.6.0.

    Fixed in 1.6.0 (released Apr 27, 2021, 14 days before disclosure).

    The latest release, 1.11.8, is not affected.