File Exfiltration Risk in OctoPrint for 3D Printer Management
CVE-2025-48067

4.6MEDIUM

Key Information:

Vendor

Octoprint

Status
Octoprint
Vendor
CVE Published:
10 June 2025

What is CVE-2025-48067?

OctoPrint, a popular web interface for managing 3D printers, is affected by a vulnerability that permits an attacker with the FILE_UPLOAD permission to extract files from the host system. This is accomplished by relocating target files to the upload folder, enabling those files to be accessed and downloaded by unauthorized users. Users are encouraged to upgrade to version 1.11.2 or later to mitigate this issue and reinforce system security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

OctoPrint < 1.11.2

References

https://github.com/OctoPrint/OctoPrint/security/advisorie...
x_refsource_CONFIRM
https://github.com/OctoPrint/OctoPrint/commit/9984b20773f...
x_refsource_MISC

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.