File Exfiltration Risk in OctoPrint for 3D Printer Management
CVE-2025-48067

5.4MEDIUM

Key Information:

Vendor

Octoprint

Status
Octoprint
Vendor
CVE Published:
10 June 2025

What is CVE-2025-48067?

OctoPrint, a popular web interface for managing 3D printers, is affected by a vulnerability that permits an attacker with the FILE_UPLOAD permission to extract files from the host system. This is accomplished by relocating target files to the upload folder, enabling those files to be accessed and downloaded by unauthorized users. Users are encouraged to upgrade to version 1.11.2 or later to mitigate this issue and reinforce system security.

Affected Version(s)

OctoPrint < 1.11.2

References

https://github.com/OctoPrint/OctoPrint/security/advisorie...
x_refsource_CONFIRM
https://github.com/OctoPrint/OctoPrint/commit/9984b20773f...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.