CVE-2026-94489: OctoPrint File Download API files.py _validate path traversal
Published Sep 21, 2026
·Updated
A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
1 affected component
OctoPrint OctoPrint=1.0.0
Event History
Sep 21, 2026
CVE Published
via MITRE·11:30 PM
Data Sourced
via MITRE·11:30 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attack can be performed remotely, but the CVSS vector indicates that low privileges are required. No user interaction is required.
2
How likely is exploitation in practice?
A public exploit is available and may be used. The reported impact is limited to confidentiality, with no integrity or availability impact listed.