CVE-2026-54134
Received Received - Intake

Path Traversal in OctoPrint Web Interface

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILE_UPLOAD permission to inject reserved internal upload fields through query parameters or parser differentials despite the earlier GHSA-m9jh-jf9h-x3h2 fix. The affected endpoints are /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file. An attacker can make OctoPrint treat an arbitrary host file as a temporary upload, move it into a downloadable upload directory, disclose configuration secrets or other readable files, and remove runtime files in a way that can affect a later restart. This issue is fixed in versions 1.11.8 and 2.0.0rc3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-54134
EUVD
EUVD-2026-64044

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
octoprint octoprint to 1.11.7|end_including=2.0.0rc2 (inc)
octoprint octoprint to 1.11.8|end_excluding=2.0.0rc3 (exc)
octoprint octoprint to 1.11.8 (inc)
octoprint octoprint to 2.0.0rc3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54134 is a high-severity vulnerability in OctoPrint versions up to 1.11.7 and 2.0.0rc1-rc2. It allows attackers with FILE_UPLOAD permissions to inject reserved internal upload fields through query parameters or parser differentials. This bypasses earlier fixes for a similar issue (GHSA-m9jh-jf9h-x3h2/CVE-2025-48067). Affected endpoints include file upload, language, backup restore, and plugin upload routes.

Detection Guidance

Check OctoPrint version with 'pip show OctoPrint' or 'octoprint --version'. If running versions <=1.11.7 or 2.0.0rc1-rc2, the system is vulnerable. Monitor logs for unusual file access or upload attempts on endpoints like /api/files/local, /api/files/sdcard, /api/languages, /plugin/backup/restore, or /plugin/pluginmanager/upload_file.

Impact Analysis

An attacker could exfiltrate sensitive files like configuration secrets or readable system files. They may also remove critical runtime files, potentially disrupting OctoPrint's operation or causing system instability. The attack requires FILE_UPLOAD permissions but has low complexity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Exposure of configuration secrets or system files may result in compliance breaches, fines, or legal consequences depending on the data involved.

Mitigation Strategies

Upgrade OctoPrint to version 1.11.8 or 2.0.0rc3 or later immediately. Remove FILE_UPLOAD permissions from untrusted users. Review logs for past exploitation attempts. Ensure backups of critical files are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54134. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart