CVE-2026-94490: OctoPrint Command API system.py executeSystemCommand os command injection
A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument command results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector lists privileges required as high, so the attacker needs high-level privileges before they can exploit the Command API remotely. User interaction is not required.
Is public exploit code available?
Yes. The disclosure states that an exploit has been released publicly and may be used in attacks.
Which deployments are known to be affected?
The reported affected product is OctoPrint version 1.0.0, specifically the Command API function executeSystemCommand in src/octoprint/server/api/system.py. The supplied information does not identify other affected versions or configuration-dependent exposure.