CVE-2025-58180

OctoPrint versions up to and including 1.11.2 contain an OS command injection flaw (CWE-78) in the handling of uploaded file names. An authenticated attacker can upload a file under a specially crafted filename; if that filename is inserted as a parameter into a system command by a configured system event handler and the event fires, arbitrary commands execute on the host running OctoPrint, yielding high impact on confidentiality, integrity and availability per the CVSS 4.0 score of 7.5. Instances that have no event handlers configured to run system commands with filename-based placeholders are not impacted by this flaw at all. All OctoPrint deployments on 1.11.2 or earlier are technically affected, but real-world exploitability depends entirely on local event-handler configuration and on who has authenticated access to the instance. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA's KEV catalog, although EPSS assigns a 20.6% probability of exploitation within 30 days (97th percentile).

What to do: Upgrade to OctoPrint 1.11.3. If upgrading is not immediately possible, disable any system event handlers that use filename-based placeholders (set their 'enabled' property to False or uncheck 'Enabled' in the Event Manager GUI), or set feature.enforceReallyUniversalFilenames to true in config.yaml and restart OctoPrint, then vet existing uploads and delete any suspicious files. Regardless, do not expose OctoPrint to hostile networks such as the public internet and restrict instance access to trusted users.