---
id: CVE-2026-54134
title: OctoPrint provides a web interface for controlling consumer 3D printers
summary: >-
  OctoPrint provides a web interface for controlling consumer 3D printers. Prior
  to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask
  with Werkzeug parse request parameters differently, allowing an attacker with
  FILE…
severity: high
cwe:
  - CWE-73
  - CWE-436
vendor: OctoPrint
product: OctoPrint
affected:
  - OctoPrint <= 1.11.7
  - 'OctoPrint >= 2.0.0rc1, <= 2.0.0rc2'
patched:
  - OctoPrint 1.11.8
  - OctoPrint 2.0.0rc3
published: '2026-08-21'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:10:00.297'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54134'
references:
  - url: >-
      https://github.com/OctoPrint/OctoPrint/commit/579148beeb6d6e9b3d41b1cf32309b47218ed380
    label: security-advisories@github.com
  - url: >-
      https://github.com/OctoPrint/OctoPrint/commit/8e3348197db867c30a32d13984f0bd0d664be413
    label: security-advisories@github.com
  - url: 'https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.8'
    label: security-advisories@github.com
  - url: 'https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-j4h9-pm27-4rfw
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-j4h9-pm27-4rfw'
tags:
  - nvd
  - ghsa
  - pip
epss: 0.00324
epssPercentile: 0.25261
ecosystem: pip
ingestedAt: '2026-06-29T13:24:35.312Z'
---

## Overview

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILE_UPLOAD permission to inject reserved internal upload fields through query parameters or parser differentials despite the earlier GHSA-m9jh-jf9h-x3h2 fix. The affected endpoints are /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file. An attacker can make OctoPrint treat an arbitrary host file as a temporary upload, move it into a downloadable upload directory, disclose configuration secrets or other readable files, and remove runtime files in a way that can affect a later restart. This issue is fixed in versions 1.11.8 and 2.0.0rc3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54134)

Affected packages:

- `OctoPrint <= 1.11.7`
- `OctoPrint >= 2.0.0rc1, <= 2.0.0rc2`

Patched in:

- `OctoPrint 1.11.8`
- `OctoPrint 2.0.0rc3`

Source: https://github.com/advisories/GHSA-j4h9-pm27-4rfw