SB20250909109 - OS Command Injection in OctoPrint

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20250909109

SB20250909109 - OS Command Injection in OctoPrint

Published: September 9, 2025 Updated: November 9, 2026

Security Bulletin ID SB20250909109
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Adjecent network
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) OS Command Injection (CVE-ID: CVE-2025-58180)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated adjacent-network attacker to execute arbitrary operating system commands on the OctoPrint host.

The vulnerability exists due to insufficient sanitization of uploaded filenames in OctoPrint when configured system event handlers include those filenames in executed commands. An authenticated adjacent-network attacker can upload a file with a specially crafted filename and achieve command execution when the corresponding event is triggered.


Remediation

Install update from vendor's website.

References