CVE-2025-58180
published 2025-09-09CVE-2025-58180: OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows…
PriorityP279high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
19.31%
97.0th percentile
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered. If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact. The vulnerability is patched in version 1.11.3. As a workaround, OctoPrint administrators who have event handlers configured that include any kind of filename based placeholders should disable those by setting their `enabled` property to `False` or unchecking the "Enabled" checkbox in the GUI based Event Manager. Alternatively, OctoPrint administrators should set `feature.enforceReallyUniversalFilenames` to `true` in `config.yaml` and restart OctoPrint, then vet the existing uploads and make sure to delete any suspicious looking files. As always, OctoPrint administrators are advised to not expose OctoPrint on hostile networks like the public internet, and to vet who has access to their instance.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| octoprint | octoprint | < 1.11.3 | 1.11.3 |
| octoprint | octoprint | >= 0 < 1.11.3 | 1.11.3 |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Octoprint File Upload File Name Command Injection Attempt (CVE-2025-58180)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:16; content:"/api/files/local"; fast_pattern; http.request_body; content:"name|3d 22|file|22 3b 20|filename|3d 22|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,www.exploit-db.com/exploits/52476; reference:cve,2025-58180; classtype:attempted-admin; sid:2067295; rev:1;)
- →Detect POST requests to /api/files/local where the multipart filename field contains shell metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24). ↗
- →Monitor for the X-Api-Key header on POST requests to /api/files/local — exploitation requires only authenticated upload privileges (no admin required), so any API key holder is a potential attacker. ↗
- ·Exploitation is only possible if OctoPrint has at least one event handler configured that executes a system command AND uses a filename-based placeholder. Instances with no such handlers are not impacted. ↗
- ·The Snort/Suricata rule (sid:2067295) is scoped to plaintext HTTP (tls_state plaintext) only; TLS-wrapped OctoPrint deployments will not be detected by this rule without SSL inspection. ↗
- ·Setting feature.enforceReallyUniversalFilenames to true in config.yaml (and restarting OctoPrint) is a viable workaround that blocks the malicious filename from being accepted, but requires a service restart to take effect. ↗
- ·Disabling affected event handlers (setting enabled: false or unchecking 'Enabled' in the GUI Event Manager) is a workaround but does not fix the underlying sanitization flaw — patching to 1.11.3 is the definitive fix. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.5HIGHCVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
ghsa·2025-09-09
CVE-2025-58180 [HIGH] CWE-78 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
### Impact
OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an **authenticated** attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered.
If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact.
### Patches
The vulnerability will be patched in version 1.11.3.
### Workaround
Until the patch has been applied, OctoPrint administrators who have event handlers configured that include any kind of filename based placeholders (i
OSV
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
osv·2025-09-09
CVE-2025-58180 [HIGH] OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
### Impact
OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an **authenticated** attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered.
If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact.
### Patches
The vulnerability will be patched in version 1.11.3.
### Workaround
Until the patch has been applied, OctoPrint administrators who have event handlers configured that include any kind of filename based placeholders (i
Suricata
ET WEB_SPECIFIC_APPS Octoprint File Upload File Name Command Injection Attempt (CVE-2025-58180)
suricata·2026-02-04·CVSS 7.5
CVE-2025-58180 [HIGH] ET WEB_SPECIFIC_APPS Octoprint File Upload File Name Command Injection Attempt (CVE-2025-58180)
ET WEB_SPECIFIC_APPS Octoprint File Upload File Name Command Injection Attempt (CVE-2025-58180)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Octoprint File Upload File Name Command Injection Attempt (CVE-2025-58180)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:16; content:"/api/files/local"; fast_pattern; http.request_body; content:"name|3d 22|file|22 3b 20|filename|3d 22|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,www.exploit-db.com/exploits/52476; reference:cve,2025-58180; classtype:attempted-admin; sid:2067295; rev:1; metadata:affected_product Octoprint, attack_target Networking_Equipment, tls_state plaintext, created_at 2026_02_04, cve CVE_2025_58180, deployme
No writeups or analysis indexed.
https://github.com/OctoPrint/OctoPrint/commit/be4201ef58d9a7c03593252398c16eada90a258bhttps://github.com/OctoPrint/OctoPrint/commit/c3a940962f4658a8e035a00388781b1cbd768841https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.3https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-49mj-x8jp-qvfc
2025-09-09
Published