OctoPrint has 9 CVEs on record between 2022 and 2026. 2 were published in the last 90 days. The median CVSS is 5.7 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.7
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Worst active — by depth score
CVE-2025-58180High· 8.8OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload65CVE-2026-54134HighOctoPrint provides a web interface for controlling consumer 3D printers41CVE-2025-48879Medium· 6.5OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint36CVE-2026-23892Medium· 5.9OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication33CVE-2025-48067Medium· 5.4OctoPrint vulnerable to possible file extraction via upload endpoints30
OctoPrint vulnerabilities
CVEs affecting OctoPrint, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-35163MediumOctoPrint provides a web interface for controlling consumer 3D printers
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/…
CVE-2026-54134HighOctoPrint provides a web interface for controlling consumer 3D printers
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILE…
CVE-2026-23892Medium· 5.9OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
CVE-2025-64187MediumOctoPrint vulnerable to XSS in Action Commands Notification and Prompt
OctoPrint vulnerable to XSS in Action Commands Notification and Prompt
CVE-2025-58180High· 8.8PoCOctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
CVE-2025-48067Medium· 5.4OctoPrint vulnerable to possible file extraction via upload endpoints
OctoPrint vulnerable to possible file extraction via upload endpoints
CVE-2025-48879Medium· 6.5OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint
OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint
CVE-2024-23637Medium· 4.2OctoPrint Unverified Password Change via Access Control Settings
OctoPrint Unverified Password Change via Access Control Settings
CVE-2022-2822Low· 3.7OctoPrint does not have rate limiting on the login page
OctoPrint does not have rate limiting on the login page