Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-94489: OctoPrint can be tricked into revealing any file
CVE-2026-94489 · published 28 days ago
Summary
The file‑download feature in OctoPrint version 1.0.0 does not properly check the name of the file being requested. An attacker who can send a specially crafted request from anywhere on the Internet could cause the system to read files outside the intended folder, potentially exposing sensitive data. Update OctoPrint to a newer version or apply the vendor’s patch to enforce proper file‑name validation.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| – | octoprint | 1.0.0 |
Original advisory text
OctoPrint File Download API files.py _validate path traversal
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The exact code first shipped in 1.6.0, does not exist in the cited 1.0.0, and in every version where it exists the claimed missing protection is already implemented.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published22 Sep 2026
Updated14 Oct 2026
First seen22 Sep 2026
Track software like this
Free during beta