{"kind": "product", "path": "vulns/pypi/octoprint", "name": "octoprint", "product": "octoprint", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-54134", "noindex": false, "published": "2026-08-21T18:28:15.925Z", "modified": "2026-08-26T17:34:27.359Z", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00324, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-54134", "title": "OctoPrint: File exfiltration possible via query parameters on upload endpoints", "description": "OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILE_UPLOAD permission to inject reserved internal upload fields through query parameters or parser differentials despite the earlier GHSA-m9jh-jf9h-x3h2 fix. The affected endpoints are /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file. An attacker can make OctoPrint treat an arbitrary host file as a temporary upload, move it into a downloadable upload directo", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-j4h9-pm27-4rfw", "https://github.com/OctoPrint/OctoPrint/commit/579148beeb6d6e9b3d41b1cf32309b47218ed380", "https://github.com/OctoPrint/OctoPrint/commit/8e3348197db867c30a32d13984f0bd0d664be413"], "fixes": ["1.11.8", "2.0.0rc3"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-35163", "noindex": false, "published": "2026-08-21T18:25:49.564Z", "modified": "2026-08-21T19:53:55.905Z", "cvss": 4.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00199, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-35163", "title": "OctoPrint: XSS in Suppressed Command Notifications", "description": "OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim's OctoPrint session. This issue is fixed in versions 1.11.8 and 2.0.0rc3.", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h", "https://github.com/OctoPrint/OctoPrint/commit/42e0f9863935e136f04ed3c560cb96483a580d1b", "https://github.com/OctoPrint/OctoPrint/commit/6e3db9096f8a94f7c2249be24b6d03a7d9c12bc7"], "fixes": ["1.11.8", "2.0.0rc3"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-23892", "noindex": false, "published": "2026-01-27T18:35:31.370Z", "modified": "2026-01-27T19:14:50.643Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00433, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-23892", "title": "OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication", "description": "OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the first mismatched character during API key validation, rather than a cryptographical method with static runtime regardless of the point of mismatch, an attacker with network based access to an affected OctoPrint could extract API keys valid on the instance by measuring the response times of the denied access responses and guess an API key character by ch", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-xg4x-w2j3-57h6", "https://github.com/OctoPrint/OctoPrint/commit/249fd80ab01bc4b7dabedff768230a0fb5d01a8c", "https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.6"], "fixes": ["1.11.6"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-64187", "noindex": false, "published": "2025-11-07T03:11:34.227Z", "modified": "2025-11-07T17:59:07.039Z", "cvss": 4.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00169, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-64187", "title": "OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts", "description": "OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. This issue is fixed in version 1.11.4", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-crvm-xjhm-9h29", "https://github.com/OctoPrint/OctoPrint/commit/9112e07b1085f4c1ee9eefc67985809251057a44", "https://nvd.nist.gov/vuln/detail/CVE-2025-64187"], "fixes": ["1.11.4"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-58180", "noindex": false, "published": "2025-09-09T19:34:14.765Z", "modified": "2025-09-10T13:59:11.561Z", "cvss": 7.5, "cvss_vector": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.22139, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-58180", "title": "OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload", "description": "OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered. If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact. The vulnerability is patched in version 1.11.3. As a workaround, OctoPrint administrators who have event ha", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-49mj-x8jp-qvfc", "https://github.com/OctoPrint/OctoPrint/commit/be4201ef58d9a7c03593252398c16eada90a258b", "https://github.com/OctoPrint/OctoPrint/commit/c3a940962f4658a8e035a00388781b1cbd768841"], "fixes": ["1.11.3"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-48879", "noindex": false, "published": "2025-06-10T15:23:54.150Z", "modified": "2025-06-10T15:57:42.371Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00256, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-48879", "title": "OctoPrint Vulnerable to Denial of Service through malformed HTTP request", "description": "OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. The issue can be triggered by a broken multipart/form-data request lacking an end boundary to any of OctoPrint's endpoints implemented through the octoprint.server.util.tornado.UploadStorageFallbackHandler request handler. The request handler will get stuck in an endless busy loop, looking for a part of the request that will never come. As Tornado is single-threaded, that will effectively block ", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-9wj4-8h85-pgrw", "https://github.com/OctoPrint/OctoPrint/commit/c9c35c17bd820f19c6b12e6c0359fc0cfdd0c1ec", "https://nvd.nist.gov/vuln/detail/CVE-2025-48879"], "fixes": ["1.11.2"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-48067", "noindex": false, "published": "2025-06-10T15:19:44.186Z", "modified": "2025-06-10T15:36:39.800Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L", "severity": "medium", "epss": 0.00263, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-48067", "title": "OctoPrint vulnerable to possible file extraction via upload endpoints", "description": "OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows an attacker with the FILE_UPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability is fixed in 1.11.2.", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-m9jh-jf9h-x3h2", "https://github.com/OctoPrint/OctoPrint/commit/9984b20773f5895a432f965b759999b16c57f7d8", "https://nvd.nist.gov/vuln/detail/CVE-2025-48067"], "fixes": ["1.11.2"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-32788", "noindex": false, "published": "2025-04-22T17:14:39.690Z", "modified": "2025-04-25T16:03:30.506Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00246, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-32788", "title": "OctoPrint Authenticated Reverse Proxy Page Authentication Bypass", "description": "OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPrint has a vulnerability that allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. The primary risk lies in potential future modifications to the codebase that might incorrectly rely on the vulnerable internal functions for authentication checks, leading to security vulnerabilities. This issue has been patched in version 1.11.0.", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-qw93-h6pf-226x", "https://github.com/OctoPrint/OctoPrint/commit/41ff431014edfa18ca1a01897b10463934dc7fc2", "https://nvd.nist.gov/vuln/detail/CVE-2025-32788"], "fixes": ["1.11.0"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-49377", "noindex": false, "published": "2024-11-05T18:20:27.173Z", "modified": "2024-11-05T19:01:22.444Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00289, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-49377", "title": "Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint", "description": "OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog.  An attacker who successfully talked a victim into clicking on a specially crafted login link, or a malicious app running on a victim's computer triggering the application key workflow with specially crafted parameters and then redirecting the victim to the related standalone confirmation dialog could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with th", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-xvxq-g8hw-fx4g", "https://nvd.nist.gov/vuln/detail/CVE-2024-49377"], "fixes": ["1.10.3"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-51493", "noindex": false, "published": "2024-11-05T18:17:29.812Z", "modified": "2024-11-05T19:01:48.187Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00281, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-51493", "title": "API key access in settings without reauthentication in OctoPrint", "description": "OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser session to retrieve/recreate/delete the user's or - if the victim has admin permissions - the global API key without having to reauthenticate by re-entering the user account's password. An attacker could use a stolen API key to access OctoPrint through its API, or disrupt workflows depending on the API key they deleted. This vulnerability will be patched in version 1.10.3 and all users are advi", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-cc6x-8cc7-9953", "https://nvd.nist.gov/vuln/detail/CVE-2024-51493"], "fixes": ["1.10.3"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-32977", "noindex": false, "published": "2024-05-14T13:49:20.862Z", "modified": "2024-08-02T02:27:53.241Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "severity": "high", "epss": 0.00897, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-32977", "title": "OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled", "description": "OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the `autologinLocal` option is enabled within `config.yaml`, even if they come from networks that are not configured as `localNetworks`, spoofing their IP via the `X-Forwarded-For` header. If autologin is not enabled, this vulnerability does not have any impact. The vulnerability has been patched in version 1.10.1. Until the patch has been applied, OctoPrint administrators who have autologin enabled on their instances", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-2vjq-hg5w-5gm7", "https://github.com/OctoPrint/OctoPrint/commit/5afbec8d23508edc25b0f1bdef1620580136add4", "https://nvd.nist.gov/vuln/detail/CVE-2024-32977"], "fixes": ["1.10.1"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-28237", "noindex": false, "published": "2024-03-18T21:17:08.139Z", "modified": "2024-08-02T15:20:14.054Z", "cvss": 4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00439, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-28237", "title": "OctoPrint XSS via the \"Snapshot Test\" feature in Classic Webcam plugin settings", "description": "OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through the \"Test\" button included in the web interface will execute JavaScript code in the victims browser when attempting to render the snapshot image. An attacker who successfully talked a victim with admin rights into performing a snapshot test with such a crafted URL could use this to retrieve or modify sensitive configuration settings, interrupt prints or", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-x7mf-wrh9-r76c", "https://github.com/OctoPrint/OctoPrint/commit/779894c1bc6478332d14bc9ed1006df1354eb517", "https://nvd.nist.gov/vuln/detail/CVE-2024-28237"], "fixes": ["1.10.0", "1.10.0rc3"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-23637", "noindex": false, "published": "2024-01-31T18:01:58.189Z", "modified": "2025-06-17T21:29:21.711Z", "cvss": 4.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00519, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-23637", "title": "OctoPrint Unverified Password Change via Access Control Settings", "description": "OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr", "https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125", "https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1"], "fixes": ["1.10.0rc1"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-41047", "noindex": false, "published": "2023-10-09T15:18:06.331Z", "modified": "2024-09-19T16:47:17.108Z", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L", "severity": "medium", "epss": 0.00587, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-41047", "title": "Improper Neutralization of Special Elements Used in a Template Engine in OctoPrint", "description": "OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An attacker might use this to extract data managed by OctoPrint, or manipulate data managed by OctoPrint, as well as execute arbitrary commands with the rights of the OctoPrint process on the server system. OctoPrint versions from 1.9.3 onward have been patched. Administrators of OctoPrint instances are advised to make sure they can trust all other administrators on their instance and to al", "references": ["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-fwfg-vprh-97ph", "https://github.com/OctoPrint/OctoPrint/commit/d0072cff894509c77e243d6562245ad3079e17db", "https://github.com/OctoPrint/OctoPrint/releases/tag/1.9.3"], "fixes": ["1.9.3"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2022-3607", "noindex": false, "published": "2022-10-19T00:00:00.000Z", "modified": "2025-05-09T14:47:37.533Z", "cvss": 6, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "severity": "medium", "epss": 0.00437, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2022-3607", "title": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint", "description": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.", "references": ["https://huntr.dev/bounties/2d1db3c9-93e8-4902-a55b-5ea53c22aa11", "https://github.com/octoprint/octoprint/commit/3cca3a43f3d085e9bbe5a5840c8255bb1b5d052e", "https://nvd.nist.gov/vuln/detail/CVE-2022-3607"], "fixes": ["1.8.3"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2022-3068", "noindex": false, "published": "2022-09-21T11:55:09.000Z", "modified": "2025-05-28T15:21:53.799Z", "cvss": 5.3, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00522, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2022-3068", "title": "Improper Privilege Management in octoprint/octoprint", "description": "Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3.", "references": ["https://huntr.dev/bounties/f45c24cb-9104-4c6e-a9e1-5c7e75e83884", "https://github.com/octoprint/octoprint/commit/ef95ef1c101b79394f134e8fce000e6bae046571", "https://nvd.nist.gov/vuln/detail/CVE-2022-3068"], "fixes": ["1.8.3"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2022-2888", "noindex": false, "published": "2022-09-21T11:25:08.000Z", "modified": "2025-05-28T15:22:09.888Z", "cvss": 4.4, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00298, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2022-2888", "title": "Insufficient Session Expiration in octoprint/octoprint", "description": "If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists.", "references": ["https://huntr.dev/bounties/d27d232b-2578-4b32-b3b4-74aabdadf629", "https://github.com/octoprint/octoprint/commit/40e6217ac1a85cc5ed592873ae49db01d3005da4", "https://nvd.nist.gov/vuln/detail/CVE-2022-2888"], "fixes": ["1.8.3"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2022-2872", "noindex": false, "published": "2022-09-21T09:55:08.000Z", "modified": "2025-05-28T15:26:59.092Z", "cvss": 3.7, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "severity": "low", "epss": 0.00697, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2022-2872", "title": "Unrestricted Upload of File with Dangerous Type in octoprint/octoprint", "description": "Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3.", "references": ["https://huntr.dev/bounties/b966c74d-6f3f-49fe-b40a-eaf25e362c56", "https://github.com/octoprint/octoprint/commit/3e3c11811e216fb371a33e28412df83f9701e5b0", "https://nvd.nist.gov/vuln/detail/CVE-2022-2872"], "fixes": ["1.8.3"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2022-2930", "noindex": false, "published": "2022-08-22T11:35:11.000Z", "modified": "2024-08-03T00:53:00.455Z", "cvss": 5.3, "cvss_vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00347, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2022-2930", "title": "Unverified Password Change in octoprint/octoprint", "description": "Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3.", "references": ["https://huntr.dev/bounties/da6745e4-7bcc-4e9a-9e96-0709ec9f2477", "https://github.com/octoprint/octoprint/commit/1453076ee3e47fcab2dc73664ec2d61d3ef7fc4f", "https://nvd.nist.gov/vuln/detail/CVE-2022-2930"], "fixes": ["1.8.3"], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}, {"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}, {"id": "CVE-2022-2822", "noindex": false, "published": "2022-08-15T10:30:17.000Z", "modified": "2024-08-03T00:52:58.435Z", "cvss": 3.7, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00867, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2022-2822", "title": "Authentication Bypass by Primary Weakness in octoprint/octoprint", "description": "An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gain access to user and administrative accounts.", "references": ["https://huntr.dev/bounties/6369f355-e6ef-4469-af75-0f6ff00cde3d", "https://github.com/octoprint/octoprint/commit/82c892ba40b3741d1b7711d949e56af64f5bc2de", "https://nvd.nist.gov/vuln/detail/CVE-2022-2822"], "fixes": [], "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}]}], "total": 24, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "octoprint", "path": "vulns/pypi/octoprint", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-08-26T17:34:27.359Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}