File Upload Vulnerability in OctoPrint 3D Printer Control Software
CVE-2026-54134

7HIGH

Key Information:

Vendor

Octoprint

Status
Octoprint
Vendor
CVE Published:
21 August 2026

What is CVE-2026-54134?

OctoPrint, a web interface designed for controlling 3D printers, contains a file upload vulnerability that allows an attacker with FILE_UPLOAD permission to exploit weaknesses in its Tornado upload handler. This security gap enables the injection of reserved internal upload fields via query parameters or parser inconsistencies. Through affected endpoints such as /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file, an attacker can force OctoPrint to treat arbitrary host files as temporary uploads. This action could result in unauthorized access to sensitive configuration files, disclosure of secrets, and the potential to disrupt system operations. Users are advised to upgrade to versions 1.11.8 or 2.0.0rc3 to mitigate this risk.

Affected Version(s)

OctoPrint < 1.11.8 < 1.11.8

OctoPrint >= 2.0.0rc1, < 2.0.0rc3 < 2.0.0rc1, 2.0.0rc3

References

https://github.com/OctoPrint/OctoPrint/security/advisorie...
x_refsource_CONFIRM
https://github.com/OctoPrint/OctoPrint/commit/579148beeb6...
x_refsource_MISC
https://github.com/OctoPrint/OctoPrint/commit/8e3348197db...
x_refsource_MISC

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.