CVE-2026-94489: OctoPrint File Download API files.py _validate path traversal
Published Sep 21, 2026
·Updated
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The exact code first shipped in 1.6.0, does not exist in the cited 1.0.0, and in every version where it exists the claimed missing protection is already implemented.
Affected Software
1 affected component
OctoPrint OctoPrint=1.0.0
Event History
Sep 21, 2026
CVE Published
via MITRE·11:30 PM
Rejected
via MITRE·11:30 PM
Sep 22, 2026
Data Sourced
via NVD·12:16 AM
Description
Oct 13, 2026
Rejected
via MITRE·03:01 PM
Rejected
via NVD·04:17 PM
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attack can be performed remotely, but the CVSS vector indicates that low privileges are required. No user interaction is required.
2
How likely is exploitation in practice?
A public exploit is available and may be used. The reported impact is limited to confidentiality, with no integrity or availability impact listed.