Log in Start free

Vulnerability · Published Aug 21, 2026 · Assigned by GitHub_M

CVE-2026-54134OctoPrint: File exfiltration possible via query parameters on upload endpoints

High 7.0

In plain English

A high-severity security flaw in OctoPrint from OctoPrint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.0High
Exploit odds (30 days)0.3%top 74.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILE_UPLOAD permission to inject reserved internal upload fields through query parameters or parser differentials despite the earlier GHSA-m9jh-jf9h-x3h2 fix. The affected endpoints are /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file. An attacker can make OctoPrint treat an arbitrary host file as a temporary upload, move it into a downloadable upload directory, disclose configuration secrets or other readable files, and remove runtime files in a way that can affect a later restart. This issue is fixed in versions 1.11.8 and 2.0.0rc3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIoctoprint1.11.8GHSA-j4h9-pm27-4rfw
PyPIoctoprint2.0.0rc3GHSA-j4h9-pm27-4rfw
PyPIoctoprint1.11.8, 2.0.0rc3PYSEC-2026-2687

Affected products (as reported)

VendorProductVersions
OctoPrint OctoPrint < 1.11.8>= 2.0.0rc1, < 2.0.0rc3

Weakness: CWE-73 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References