CVE-2026-54134 OctoPrint CVE debrief

Who should care

OctoPrint users and administrators, 3D printing service providers, and organizations using OctoPrint for managing 3D printers should prioritize patching to prevent potential arbitrary file uploads and configuration disclosure. These stakeholders should review and update configuration files for potential exposure, monitor OctoPrint instances for suspicious activity, and restrict FILE_UPLOAD permissions to trusted users. Additionally, they should consider implementing compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

CVE-2026-54134 is a vulnerability in OctoPrint versions prior to 1.11.8 and 2.0.0rc3, allowing an attacker with FILE_UPLOAD permission to inject reserved internal upload fields, potentially leading to arbitrary file uploads and configuration disclosure. The vulnerability affects OctoPrint's custom Tornado upload handler and Flask with Werkzeug, which parse request parameters differently. This discrepancy enables attackers to inject reserved internal upload fields through query parameters or parser differentials. Affected endpoints include /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file.

Defensive priority

OctoPrint users should prioritize patching to prevent potential arbitrary file uploads and configuration disclosure.

Recommended defensive actions

• Apply patches to OctoPrint versions 1.11.8 or 2.0.0rc3 to fix the vulnerability
• Restrict FILE_UPLOAD permissions to trusted users
• Monitor OctoPrint instances for suspicious activity
• Review and update configuration files for potential exposure
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Conduct an asset inventory to identify potentially affected systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in OctoPrint versions prior to 1.11.8 and 2.0.0rc3. Evidence is based on official CVE and NVD records, as well as OctoPrint security advisories. To verify, defenders should review the official CVE record and OctoPrint security advisories for affected versions and update to 1.11.8 or 2.0.0rc3. Additional verification steps include reviewing configuration files for potential exposure and monitoring OctoPrint instances for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.