OctoPrint vulnerabilities
We track 4 vulnerabilities in OctoPrint products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 21, 2026.
Latest OctoPrint vulnerabilities
- 7.0 High severity
OctoPrint: External Control of File Name or Path
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILE_UPLOAD permission to i
- 8.8 High severity
OctoPrint: Improper Neutralization of Special Elements used in an OS Command
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrar
- 9.4 Critical severity
OctoPrint: Authentication Bypass by Spoofing
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the `autologinLocal` option is
- 7.5 High severity
octoprint/octoprint: Improper Restriction of Excessive Authentication Attempts
An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.