CVE-2025-48067: OctoPrint vulnerable to possible file extraction via upload endpoints
Impact
OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows an attacker with the FILEUPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from.
The primary risk lies in the potential exfiltration of secrets stored inside OctoPrint's config, or further system files. By removing important runtime files, this could also be used to impact the availability of the host. Given that the attacker requires a user account with file upload permissions, the actual impact of this should however hopefully be minimal in most cases.
Patches
The vulnerability has been patched in version 1.11.2.
Details
A specially crafted HTTP Request to an affected upload endpoint that contains some form inputs only supposed to be used internally can be used to make OctoPrint move a file that it thinks is a freshly uploaded temporary one into its upload folder.
The following endpoints in OctoPrint are affected:
- /api/files/{local|sdcard} - /api/languages - /plugin/backup/restore - /plugin/pluginmanager/uploadfile
Further upload endpoints in third party plugins might be affected too.
The fix removes any internal-only form inputs from incoming requests in the central file upload processor component.
Credits
This vulnerability was discovered and responsibly disclosed to OctoPrint by Jacopo Tediosi
Other sources
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows an attacker with the FILEUPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability is fixed in 1.11.2.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48067?
CVE-2025-48067 is considered a moderate severity vulnerability due to the potential for file exfiltration.
How do I fix CVE-2025-48067?
To fix CVE-2025-48067, upgrade to OctoPrint version 1.11.2 or later.
What kind of permission is required to exploit CVE-2025-48067?
CVE-2025-48067 requires the attacker to have the `FILE_UPLOAD` permission to exploit the vulnerability.
What can an attacker do if they exploit CVE-2025-48067?
If exploited, CVE-2025-48067 allows an attacker to exfiltrate files from the host system that OctoPrint can access.
Which versions of OctoPrint are affected by CVE-2025-48067?
CVE-2025-48067 affects all OctoPrint versions up to and including 1.11.1.