SB20250610114 - Multiple vulnerabilities in OctoPrint

Description

This security bulletin contains information about 2 vulnerabilities.

1) Infinite loop (CVE-ID: CVE-2025-48879)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated adjacent-network attacker to make OctoPrint's web server unresponsive, denying access to its web interface.

The vulnerability exists due to an endless loop in OctoPrint's upload request handler when a malformed multipart/form-data request lacks a closing boundary. An unauthenticated adjacent-network attacker can send this request to an endpoint using the affected handler and block the entire web server without victim interaction.

2) External Control of File Name or Path (CVE-ID: CVE-2025-48067)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an adjacent-network attacker with FILE_UPLOAD permission to exfiltrate host files that OctoPrint can read, including configuration secrets.

The vulnerability exists due to OctoPrint's upload processor accepting internal-only form inputs from crafted HTTP requests and treating attacker-selected host files as temporary uploads. An adjacent-network attacker with FILE_UPLOAD permission can submit these inputs to an affected upload endpoint to move a readable host file into the upload folder and download it.

Remediation

Install update from vendor's website.

References

• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-9wj4-8h85-pgrw
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-m9jh-jf9h-x3h2