CVE-2025-581807.5HighCWE-78

CVE-2025-58180: OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload

OctoPrint

Affected: OctoPrint · Exploitation: likely to be exploited (10% or more)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

26.1%probability of exploitation in the next 30 days

98th percentile

050100

Higher than 98% of scored CVEs

7.5HighCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered. If no event handlers executing system commands with uploaded filenames as parameters have been configured, this vulnerability does not have an impact. The vulnerability is patched in version 1.11.3. As a workaround, OctoPrint administrators who have event handlers configured that include any kind of filename based placeholders should disable those by setting their `enabled` property to `False` or unchecking the "Enabled" checkbox in the GUI based Event Manager. Alternatively, OctoPrint administrators should set `feature.enforceReallyUniversalFilenames` to `true` in `config.yaml` and restart OctoPrint, then vet the existing uploads and make sure to delete any suspicious looking files. As always, OctoPrint administrators are advised to not expose OctoPrint on hostile networks like the public internet, and to vet who has access to their instance.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

OctoPrint · OctoPrint< 1.11.3

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Likely to be exploited (10% or more). EPSS gives it a 10% or higher chance of exploitation in the next 30 days.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: OS Command Injection · Command and Code Injection
Vendor: OctoPrint
Published: September 2025
Band: Likely to be exploited (10% or more), September 2025

CoverageNo articles yet

No CyberSIXT article names CVE-2025-58180 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.