OS Command Injection in OctoPrint - CVE-2025-58180
Published: September 9, 2025 / Updated: November 9, 2026
Vulnerability identifier: #VU162906
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-58180
CWE-ID: CWE-78
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated adjacent-network attacker to execute arbitrary operating system commands on the OctoPrint host.
The vulnerability exists due to insufficient sanitization of uploaded filenames in OctoPrint when configured system event handlers include those filenames in executed commands. An authenticated adjacent-network attacker can upload a file with a specially crafted filename and achieve command execution when the corresponding event is triggered.
Affected software
OctoPrint
How to mitigate CVE-2025-58180
Install security update from vendor's website.
OctoPrint - update to 1.11.3