# octoprint (PyPI) vulnerabilities 24 known vulnerabilities (5 high, 15 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.11.8 (Jun 23, 2026): no advisory affects it - Newest unaffected release: 1.11.8 (Jun 23, 2026), the latest release - Weekly downloads: 4,674 - Dependents: 10 - Releases: 89 since 1.3.11 (Sep 4, 2019) - Registry: https://pypi.org/project/octoprint/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-54134: 1.3.11 to 1.11.7 (1.11.8 is outside it); 2.0.0rc1 to 2.0.0rc2 (2.0.0rc3 is outside it) - CVE-2026-35163: 1.3.11 to 1.11.7 (1.11.8 is outside it); 2.0.0rc1 to 2.0.0rc2 (2.0.0rc3 is outside it) - CVE-2026-23892: 1.3.11 to 1.11.5 (1.11.6 is outside it) - CVE-2025-64187: 1.3.11 to 1.11.3 (1.11.4 is outside it) - CVE-2025-58180: 1.3.11 to 1.11.2 (1.11.3 is outside it) - CVE-2025-48879: 1.3.11 to 1.11.1 (1.11.2 is outside it) - CVE-2025-48067: 1.3.11 to 1.11.1 (1.11.2 is outside it) - CVE-2025-32788: 1.3.11 to 1.11.0rc7 (1.11.0 is outside it) - CVE-2024-49377: 1.3.11 to 1.10.2 (1.10.3 is outside it) - CVE-2024-51493: 1.3.11 to 1.10.2 (1.10.3 is outside it) - CVE-2024-32977: 1.3.11 to 1.10.0 (1.10.1 is outside it) - CVE-2024-28237: 1.3.11 to 1.10.0rc4 (1.10.0 is outside it) - CVE-2024-23637: 1.3.11 to 1.9.3 (1.10.0rc1 is outside it) - CVE-2023-41047: 1.3.11 to 1.9.2 (1.9.3 is outside it) - CVE-2022-3607: 1.3.11 to 1.8.2 (1.8.3 is outside it) - CVE-2022-3068: 1.3.11 to 1.8.2 (1.8.3 is outside it) - CVE-2022-2888: 1.3.11 to 1.8.2 (1.8.3 is outside it) - CVE-2022-2872: 1.3.11 to 1.8.2 (1.8.3 is outside it) - CVE-2022-2930: 1.3.11 to 1.8.2 (1.8.3 is outside it) - CVE-2022-2822: 1.3.11 to 1.7.3 (1.8.0rc1 is outside it) - CVE-2022-1432: 1.3.11 to 1.8.0rc5 (1.8.0 is outside it) - CVE-2022-1430: 1.3.11 to 1.8.0rc5 (1.8.0 is outside it) - CVE-2021-32561: 1.3.11 to 1.6.0rc3 (1.6.0 is outside it) - CVE-2021-32560: 1.3.11 to 1.6.0rc3 (1.6.0 is outside it) ## Advisories (24) ### [CVE-2026-54134](https://cve.now/CVE-2026-54134): OctoPrint: File exfiltration possible via query parameters on upload endpoints - Severity: High 7.0 - Published: Aug 21, 2026 - Affected: fixed in 1.11.8; from 2.0.0rc1, fixed in 2.0.0rc3; fixed in 1.11.8; from 2.0.0rc1, fixed in 2.0.0rc3. - Fixed in 1.11.8 (released Jun 23, 2026, 59 days before disclosure) and 2.0.0rc3 (released Jun 23, 2026, 59 days before disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2026-35163](https://cve.now/CVE-2026-35163): OctoPrint: XSS in Suppressed Command Notifications - Severity: Medium 4.6 - Published: Aug 21, 2026 - Affected: fixed in 1.11.8; from 2.0.0rc1, fixed in 2.0.0rc3; fixed in 1.11.8; from 2.0.0rc1, fixed in 2.0.0rc3. - Fixed in 1.11.8 (released Jun 23, 2026, 59 days before disclosure) and 2.0.0rc3 (released Jun 23, 2026, 59 days before disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2026-23892](https://cve.now/CVE-2026-23892): OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication - Severity: Medium 6.0 - Published: Jan 27, 2026 - Affected: fixed in 1.11.6. - Fixed in 1.11.6 (released Jan 27, 2026, the day of disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2025-64187](https://cve.now/CVE-2025-64187): OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts - Severity: Medium 4.6 - Published: Nov 7, 2025 - Affected: fixed in 1.11.4. - Fixed in 1.11.4 (released Nov 4, 2025, 3 days before disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2025-58180](https://cve.now/CVE-2025-58180): OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload - Severity: High 7.5 - Published: Sep 9, 2025 - Affected: fixed in 1.11.3. - Fixed in 1.11.3 (released Sep 9, 2025, the day of disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2025-48879](https://cve.now/CVE-2025-48879): OctoPrint Vulnerable to Denial of Service through malformed HTTP request - Severity: Medium 6.5 - Published: Jun 10, 2025 - Affected: fixed in 1.11.2. - Fixed in 1.11.2 (released Jun 10, 2025, the day of disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2025-48067](https://cve.now/CVE-2025-48067): OctoPrint vulnerable to possible file extraction via upload endpoints - Severity: Medium 5.4 - Published: Jun 10, 2025 - Affected: fixed in 1.11.2. - Fixed in 1.11.2 (released Jun 10, 2025, the day of disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2025-32788](https://cve.now/CVE-2025-32788): OctoPrint Authenticated Reverse Proxy Page Authentication Bypass - Severity: Medium 4.3 - Published: Apr 22, 2025 - Affected: fixed in 1.11.0. - Fixed in 1.11.0 (released Apr 22, 2025, the day of disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2024-49377](https://cve.now/CVE-2024-49377): Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint - Severity: Medium 5.5 - Published: Nov 5, 2024 - Affected: fixed in 1.10.3. - Fixed in 1.10.3 (released Nov 5, 2024, the day of disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2024-51493](https://cve.now/CVE-2024-51493): API key access in settings without reauthentication in OctoPrint - Severity: Medium 5.3 - Published: Nov 5, 2024 - Affected: fixed in 1.10.3. - Fixed in 1.10.3 (released Nov 5, 2024, the day of disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2024-32977](https://cve.now/CVE-2024-32977): OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled - Severity: High 7.1 - Published: May 14, 2024 - Affected: fixed in 1.10.1; fixed in 1.10.1. - Fixed in 1.10.1 (released May 14, 2024, the day of disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2024-28237](https://cve.now/CVE-2024-28237): OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings - Severity: Medium 4.0 - Published: Mar 18, 2024 - Affected: fixed in 1.10.0; fixed in 1.10.0rc3. - Fixed in 1.10.0 (released Apr 24, 2024, 37 days after disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2024-23637](https://cve.now/CVE-2024-23637): OctoPrint Unverified Password Change via Access Control Settings - Severity: Medium 4.2 - Published: Jan 31, 2024 - Affected: fixed in 1.10.0rc1. - Fixed in 1.10.0rc1 (released Jan 31, 2024, the day of disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2023-41047](https://cve.now/CVE-2023-41047): Improper Neutralization of Special Elements Used in a Template Engine in OctoPrint - Severity: Medium 6.2 - Published: Oct 9, 2023 - Affected: fixed in 1.9.3. - Fixed in 1.9.3 (released Oct 9, 2023, the day of disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2022-3607](https://cve.now/CVE-2022-3607): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint - Severity: Medium 6.0 - Published: Oct 19, 2022 - Affected: fixed in 1.8.3; fixed in 1.8.3. - Fixed in 1.8.3 (released Sep 20, 2022, 29 days before disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2022-3068](https://cve.now/CVE-2022-3068): Improper Privilege Management in octoprint/octoprint - Severity: Medium 5.3 - Published: Sep 21, 2022 - Affected: fixed in 1.8.3; fixed in 1.8.3. - Fixed in 1.8.3 (released Sep 20, 2022, 1 day before disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2022-2888](https://cve.now/CVE-2022-2888): Insufficient Session Expiration in octoprint/octoprint - Severity: Medium 4.4 - Published: Sep 21, 2022 - Affected: fixed in 1.8.3; fixed in 1.8.3. - Fixed in 1.8.3 (released Sep 20, 2022, 1 day before disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2022-2872](https://cve.now/CVE-2022-2872): Unrestricted Upload of File with Dangerous Type in octoprint/octoprint - Severity: Low 3.7 - Published: Sep 21, 2022 - Affected: fixed in 1.8.3; fixed in 1.8.3. - Fixed in 1.8.3 (released Sep 20, 2022, 1 day before disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2022-2930](https://cve.now/CVE-2022-2930): Unverified Password Change in octoprint/octoprint - Severity: Medium 5.3 - Published: Aug 22, 2022 - Affected: fixed in 1.8.3; fixed in 1.8.3. - Fixed in 1.8.3 (released Sep 20, 2022, 29 days after disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2022-2822](https://cve.now/CVE-2022-2822): Authentication Bypass by Primary Weakness in octoprint/octoprint - Severity: Low 3.7 - Published: Aug 15, 2022 - Affected: through 1.7.3. - Fixed in 1.8.0 (released May 17, 2022, 90 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.11.8, is not affected. ### [CVE-2022-1432](https://cve.now/CVE-2022-1432): Cross-site Scripting (XSS) - Generic in octoprint/octoprint - Severity: High 7.5 - Published: May 18, 2022 - Affected: fixed in 1.8.0. - Fixed in 1.8.0 (released May 17, 2022, 1 day before disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2022-1430](https://cve.now/CVE-2022-1430): Cross-site Scripting (XSS) - DOM in octoprint/octoprint - Severity: High 7.5 - Published: May 18, 2022 - Affected: fixed in 1.8.0. - Fixed in 1.8.0 (released May 17, 2022, 1 day before disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2021-32561](https://cve.now/CVE-2021-32561): OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters. - Severity: Unrated - Published: May 11, 2021 - Affected: fixed in 1.6.0. - Fixed in 1.6.0 (released Apr 27, 2021, 14 days before disclosure). - The latest release, 1.11.8, is not affected. ### [CVE-2021-32560](https://cve.now/CVE-2021-32560): The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not \*.log files. - Severity: Unrated - Published: May 11, 2021 - Affected: fixed in 1.6.0. - Fixed in 1.6.0 (released Apr 27, 2021, 14 days before disclosure). - The latest release, 1.11.8, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/octoprint Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.