CVE-2025-48067: fallo de gravedad media en OctoPrint
OctoPrint vulnerable to possible file extraction via upload endpoints
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.3%
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows an attacker with the FILE_UPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability is fixed in 1.11.2.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Productos afectados
OctoPrint · OctoPrintCVEs relacionadas — OctoPrint
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-58180HIGHOctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File UploadEPSS 26.1%CVE-2024-32977HIGHOctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabledEPSS 0.9%CVE-2023-41047MEDIUMImproper Neutralization of Special Elements Used in a Template Engine in OctoPrintEPSS 0.6%CVE-2024-23637MEDIUMOctoPrint Unverified Password Change via Access Control SettingsEPSS 0.5%CVE-2024-28237MEDIUMOctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settingsEPSS 0.4%CVE-2026-23892MEDIUMOctoPrint has Timing Side-Channel Vulnerability in API Key AuthenticationEPSS 0.4%