{"items":[{"id":"NVI-00016421","kind":"vulnerability","title":"OctoPrint has possible file exfiltration via query parameters on upload endpoints","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-j4h9-pm27-4rfw","CVE-2026-54134"],"plain_summary":"GitHub lists this reviewed advisory for OctoPrint, OctoPrint. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6f547118990fd49bf0abf6f17d7b4044"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6f547118990fd49bf0abf6f17d7b4044","url":"https://github.com/advisories/GHSA-j4h9-pm27-4rfw","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-j4h9-pm27-4rfw","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T09:56:46.713Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6f547118990fd49bf0abf6f17d7b4044"],"technology":"OctoPrint","known_exclusions":[],"conditions_summary":"### Impact\n\nOctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the `FILE_UPLOAD` permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability was already reported as GHSA-m9jh-jf9h-x3h2/CVE-2025-48067 but the fix provided in OctoPrint 1.11.2 turned out to be incomplete.\n\nThe primary risk lies in the potential exfiltration of secrets stored inside OctoPrint's config, or further system files. By removing important runtime files, this could also be used to impact the availability of the host after an attempted server restart. Given that the attacker requires a user account with file upload permissions, the actual impact of this should however hopefully be minimal in most cases.\n\n### Patches\n\nThe vulnerability has been patched in version 1.11.8 and 2.0.0rc3.\n\n### Details\n\nOctoPrint's web application is implemented in Flask, but uploads are first intercepted by a custom upload handler built on Tornado that sit","public_affected_ranges":["<= 1.11.7"]},{"certainty":"source_listed","source_ids":["sr-6f547118990fd49bf0abf6f17d7b4044"],"technology":"OctoPrint","known_exclusions":[],"conditions_summary":"### Impact\n\nOctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the `FILE_UPLOAD` permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability was already reported as GHSA-m9jh-jf9h-x3h2/CVE-2025-48067 but the fix provided in OctoPrint 1.11.2 turned out to be incomplete.\n\nThe primary risk lies in the potential exfiltration of secrets stored inside OctoPrint's config, or further system files. By removing important runtime files, this could also be used to impact the availability of the host after an attempted server restart. Given that the attacker requires a user account with file upload permissions, the actual impact of this should however hopefully be minimal in most cases.\n\n### Patches\n\nThe vulnerability has been patched in version 1.11.8 and 2.0.0rc3.\n\n### Details\n\nOctoPrint's web application is implemented in Flask, but uploads are first intercepted by a custom upload handler built on Tornado that sit","public_affected_ranges":[">= 2.0.0rc1, <= 2.0.0rc2"]}],"null_published_at":"2026-11-04T10:04:27.943Z","source_updated_at":"2026-08-21T18:28:36.000Z","source_disclosed_at":"2026-06-23T18:03:54.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T09:56:46.713Z"}],"next_cursor":null,"snapshot_revision":"39771"}