CVE-2025-58180
NoneOctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
CVSS
—
EPSS
22.1%
Published
Sep 9, 2025
CISA due date
—
The record
OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an **authenticated** attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered. If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | octoprint | 0 | 1.11.3 |
Related vulnerabilities
- CVE-2026-23892 OctoPrint provides a web interface for controlling consumer 3D printers. Also affects octoprint
- GHSA-xg4x-w2j3-57h6 OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication Also affects octoprint
- CVE-2025-64187 OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts Also affects octoprint
- GHSA-crvm-xjhm-9h29 OctoPrint vulnerable to XSS in Action Commands Notification and Prompt Also affects octoprint
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78