octoprint (PyPI)
Advisories
50
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.0.0rc3 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "octoprint>=2.0.0rc3"poetry
poetry add "octoprint>=2.0.0rc3"uv
uv add "octoprint>=2.0.0rc3"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-j4h9-pm27-4rfw OctoPrint has possible file exfiltration via query parameters on upload endpoints |
High EPSS 0.32% |
< 1.11.8 | 1.11.8 |
| GHSA-j4h9-pm27-4rfw OctoPrint has possible file exfiltration via query parameters on upload endpoints |
High EPSS 0.32% |
>= 2.0.0rc1, < 2.0.0rc3 | 2.0.0rc3 |
| GHSA-j4h9-pm27-4rfw OctoPrint has possible file exfiltration via query parameters on upload endpoints |
High EPSS 0.32% |
< 1.11.8>= 2.0.0rc1, < 2.0.0rc3 | 1.11.82.0.0rc3 |
| GHSA-p6qx-ghxm-389h OctoPrint has XSS in its Suppressed Command Notifications |
Medium EPSS 0.20% |
< 1.11.8 | 1.11.8 |
| GHSA-p6qx-ghxm-389h OctoPrint has XSS in its Suppressed Command Notifications |
Medium EPSS 0.20% |
>= 2.0.0rc1, < 2.0.0rc3 | 2.0.0rc3 |
| GHSA-p6qx-ghxm-389h OctoPrint has XSS in its Suppressed Command Notifications |
Medium EPSS 0.20% |
< 1.11.8>= 2.0.0rc1, < 2.0.0rc3 | 1.11.82.0.0rc3 |
| GHSA-xg4x-w2j3-57h6 OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication |
Medium EPSS 0.43% |
< 1.11.6 | 1.11.6 |
| GHSA-xg4x-w2j3-57h6 OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication |
Medium EPSS 0.43% |
< 1.11.6 | 1.11.6 |
| GHSA-crvm-xjhm-9h29 OctoPrint vulnerable to XSS in Action Commands Notification and Prompt |
Medium EPSS 0.17% |
< 1.11.4 | 1.11.4 |
| GHSA-crvm-xjhm-9h29 OctoPrint vulnerable to XSS in Action Commands Notification and Prompt |
Medium EPSS 0.17% |
< 1.11.4 | 1.11.4 |
| GHSA-49mj-x8jp-qvfc OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload |
High EPSS 22.14% |
< 1.11.3 | 1.11.3 |
| GHSA-49mj-x8jp-qvfc OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload |
High EPSS 22.14% |
< 1.11.3 | 1.11.3 |
| GHSA-9wj4-8h85-pgrw OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint |
Medium EPSS 0.26% |
< 1.11.2 | 1.11.2 |
| GHSA-9wj4-8h85-pgrw OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint |
Medium EPSS 0.26% |
< 1.11.2 | 1.11.2 |
| GHSA-m9jh-jf9h-x3h2 OctoPrint vulnerable to possible file extraction via upload endpoints |
Medium EPSS 0.26% |
< 1.11.2 | 1.11.2 |
| GHSA-m9jh-jf9h-x3h2 OctoPrint vulnerable to possible file extraction via upload endpoints |
Medium EPSS 0.26% |
< 1.11.2 | 1.11.2 |
| GHSA-qw93-h6pf-226x OctoPrint Authenticated Reverse Proxy Page Authentication Bypass |
Medium EPSS 0.25% |
< 1.11.0 | 1.11.0 |
| GHSA-qw93-h6pf-226x OctoPrint Authenticated Reverse Proxy Page Authentication Bypass |
Medium EPSS 0.25% |
< 1.11.0 | 1.11.0 |
| GHSA-cc6x-8cc7-9953 OctoPrint has API key access in settings without reauthentication |
Medium EPSS 0.28% |
< 1.10.3 | 1.10.3 |
| GHSA-cc6x-8cc7-9953 OctoPrint has API key access in settings without reauthentication |
Medium EPSS 0.28% |
< 1.10.3 | 1.10.3 |
| GHSA-xvxq-g8hw-fx4g OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates |
Medium EPSS 0.29% |
< 1.10.3 | 1.10.3 |
| GHSA-xvxq-g8hw-fx4g OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates |
Medium EPSS 0.29% |
< 1.10.3 | 1.10.3 |
| GHSA-2vjq-hg5w-5gm7 OctoPrint has an Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled |
Critical EPSS 0.90% |
< 1.10.1 | 1.10.1 |
| GHSA-2vjq-hg5w-5gm7 OctoPrint has an Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled |
Critical EPSS 0.90% |
< 1.10.1 | 1.10.1 |
| GHSA-x7mf-wrh9-r76c XSS via the "Snapshot Test" feature in Classic Webcam plugin settings |
Medium EPSS 0.44% |
< 1.10.0rc3 | 1.10.0rc3 |
| GHSA-x7mf-wrh9-r76c XSS via the "Snapshot Test" feature in Classic Webcam plugin settings |
Medium EPSS 0.44% |
< 1.10.0 | 1.10.0 |
| GHSA-5626-pw9c-hmjr OctoPrint Unverified Password Change via Access Control Settings |
Medium EPSS 0.52% |
< 1.10.0rc1 | 1.10.0rc1 |
| GHSA-5626-pw9c-hmjr OctoPrint Unverified Password Change via Access Control Settings |
Medium EPSS 0.52% |
< 1.10.0rc1 | 1.10.0rc1 |
| GHSA-fwfg-vprh-97ph OctoPrint vulnerable to Improper Neutralization of Special Elements Used in a Template Engine |
Medium EPSS 0.59% |
< 1.9.3 | 1.9.3 |
| GHSA-fwfg-vprh-97ph OctoPrint vulnerable to Improper Neutralization of Special Elements Used in a Template Engine |
Medium EPSS 0.59% |
< 1.9.3 | 1.9.3 |
| GHSA-rj5f-vm79-5j84 OctoPrint vulnerable to Special Element Injection |
Medium EPSS 0.44% |
< 1.8.3 | 1.8.3 |
| GHSA-rj5f-vm79-5j84 OctoPrint vulnerable to Special Element Injection |
Medium EPSS 0.44% |
< 1.8.3 | 1.8.3 |
| GHSA-2p75-q37p-f852 OctoPrint Improper Privilege Management vulnerability |
High EPSS 0.52% |
< 1.8.3 | 1.8.3 |
| GHSA-937f-qh3w-6g87 OctoPrint vulnerable to Insufficient Session Expiration. |
Medium EPSS 0.30% |
< 1.8.3 | 1.8.3 |
| GHSA-937f-qh3w-6g87 OctoPrint vulnerable to Insufficient Session Expiration. |
Medium EPSS 0.30% |
< 1.8.3 | 1.8.3 |
| GHSA-2p75-q37p-f852 OctoPrint Improper Privilege Management vulnerability |
High EPSS 0.52% |
< 1.8.3 | 1.8.3 |
| GHSA-49wm-4fp6-h59c OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type |
Low EPSS 0.70% |
< 1.8.3 | 1.8.3 |
| GHSA-49wm-4fp6-h59c OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type |
Low EPSS 0.70% |
< 1.8.3 | 1.8.3 |
| GHSA-39gf-864w-pxw4 Unverified Password Change in OctoPrint |
Medium EPSS 0.35% |
< 1.8.3 | 1.8.3 |
| GHSA-39gf-864w-pxw4 Unverified Password Change in OctoPrint |
Medium EPSS 0.35% |
< 1.8.3 | 1.8.3 |
| GHSA-5w5x-q9p5-9qg3 OctoPrint does not have rate limiting on the login page |
Low EPSS 0.87% |
<= 1.7.3 | No fix yet |
| GHSA-5w5x-q9p5-9qg3 OctoPrint does not have rate limiting on the login page |
Low EPSS 0.87% |
<= 1.7.3 | No fix yet |
| GHSA-x7r7-wmj8-vv5g Cross-site Scripting in OctoPrint |
High EPSS 1.36% |
< 1.8.0 | 1.8.0 |
| GHSA-h8pc-j334-jjhm Cross-site Scripting in OctoPrint |
High EPSS 1.23% |
< 1.8.0 | 1.8.0 |
| GHSA-x7r7-wmj8-vv5g Cross-site Scripting in OctoPrint |
High EPSS 1.36% |
< 1.8.0 | 1.8.0 |
| GHSA-h8pc-j334-jjhm Cross-site Scripting in OctoPrint |
High EPSS 1.23% |
< 1.8.0 | 1.8.0 |
| GHSA-x9rq-fjp5-qgm9 OctoPrint Incorrect Access Control |
Medium EPSS 1.50% |
< 1.6.0 | 1.6.0 |
| GHSA-vcx4-fpmp-mvv6 OctoPrint API Error Messages vulnerable to XSS |
Medium EPSS 1.15% |
< 1.6.0 | 1.6.0 |
| GHSA-x9rq-fjp5-qgm9 OctoPrint Incorrect Access Control |
Medium EPSS 1.50% |
< 1.6.0 | 1.6.0 |
| GHSA-vcx4-fpmp-mvv6 OctoPrint API Error Messages vulnerable to XSS |
Medium EPSS 1.15% |
< 1.6.0 | 1.6.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor