CVE-2026-54134: OctoPrint Path Traversal Vulnerability

CVE-2026-54134 Overview

CVE-2026-54134 is a file disclosure and manipulation vulnerability in OctoPrint, a widely deployed web interface for controlling consumer 3D printers. The flaw affects versions prior to 1.11.8 and 2.0.0rc3. It stems from a parser differential between OctoPrint's custom Tornado upload handler and Flask with Werkzeug. An authenticated attacker holding the FILE_UPLOAD permission can inject reserved internal upload fields through query parameters, bypassing the earlier GHSA-m9jh-jf9h-x3h2 fix. The issue is tracked under [CWE-73: External Control of File Name or Path].

Critical Impact
An attacker can force OctoPrint to treat arbitrary host files as temporary uploads, disclose configuration secrets, and remove runtime files impacting later restarts.

Affected Products

OctoPrint versions prior to 1.11.8
OctoPrint 2.x versions prior to 2.0.0rc3
Affected endpoints: /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, /plugin/pluginmanager/upload_file

Discovery Timeline

2026-08-21 - CVE-2026-54134 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-54134

Vulnerability Analysis

OctoPrint exposes multiple upload endpoints backed by a custom Tornado request handler. Once accepted, requests are processed downstream by Flask with Werkzeug. The two frameworks parse request parameters differently, producing a parser differential. This mismatch allows a client to smuggle reserved internal upload fields, such as the temporary file path, through URL query parameters. The earlier fix from GHSA-m9jh-jf9h-x3h2 filtered these fields at only one layer. Attackers with the FILE_UPLOAD permission can therefore reintroduce them via the divergent parser path.

Root Cause

The root cause is inconsistent parameter parsing between the Tornado front-end handler and the Werkzeug back-end. Reserved upload fields that should originate only from internal Tornado logic can be supplied by the client through query strings. Because OctoPrint trusts these fields when reconstructing the upload context, the server operates on attacker-controlled file paths.

Attack Vector

An authenticated user with FILE_UPLOAD permission sends a crafted upload request to one of the vulnerable endpoints. The attacker injects reserved fields via query parameters to make OctoPrint treat an arbitrary host file as a temporary upload. That file is then moved into a downloadable upload directory, enabling disclosure of config.yaml secrets, API keys, or any world-readable file on the host. The same primitive can remove runtime files, affecting subsequent restarts.

python

# Security patch in src/octoprint/server/api/files.py
# fix(api): fix new iteration of CVE-2025-48067
            return fileManager.last_modified(
                storage, path=path_in_storage, recursive=recursive
            )
+        except FileNotFoundError:
+            return None
         except Exception:
             logging.getLogger(__name__).exception(
                 "There was an error retrieving the last modified data from storage {} and path {}".format(
# Source: https://github.com/OctoPrint/OctoPrint/commit/8e3348197db867c30a32d13984f0bd0d664be413

Detection Methods for CVE-2026-54134

Indicators of Compromise

Unexpected files appearing in OctoPrint's uploads directory that do not match user-initiated print jobs or gcode content.
Missing or truncated runtime files (config.yaml, plugin state files) observed after a restart.
HTTP POST requests to /api/files/local, /api/files/sdcard, /api/languages, /plugin/backup/restore, or /plugin/pluginmanager/upload_file containing suspicious query string parameters referencing absolute host paths.

Detection Strategies

Inspect reverse proxy or web server access logs for upload endpoint requests carrying query parameters that reference reserved multipart field names or filesystem paths.
Correlate FILE_UPLOAD-scoped API activity with subsequent GET requests that download files from the uploads directory.
Audit OctoPrint logs (octoprint.log) for parser warnings and unexpected file movement events near upload activity.

Monitoring Recommendations

Enable Tornado tornado.general logging at WARNING level, as introduced by the vendor patch, to surface parser anomalies.
Monitor file integrity of the OctoPrint configuration directory (~/.octoprint/) using host-based integrity monitoring.
Track creation, modification, and deletion events for files under the OctoPrint runtime and uploads directories.

How to Mitigate CVE-2026-54134

Immediate Actions Required

Upgrade OctoPrint to version 1.11.8 or 2.0.0rc3 without delay.
Review and rotate any secrets stored in config.yaml, including API keys, cloud credentials, and access tokens.
Audit accounts holding the FILE_UPLOAD permission and revoke access that is not strictly required.

Patch Information

OctoPrint addressed CVE-2026-54134 in the 1.11.8 release and 2.0.0rc3 release. The fix is implemented across two commits: commit 579148b and commit 8e33481. Full technical detail is available in the GitHub Security Advisory GHSA-j4h9-pm27-4rfw.

Workarounds

Restrict network exposure of the OctoPrint web interface to trusted management networks only, since the attack requires adjacent network access.
Remove the FILE_UPLOAD permission from all non-administrative user groups until patching is complete.
Place OctoPrint behind an authenticating reverse proxy that strips query parameters from POST requests to upload endpoints.

bash

# Verify installed OctoPrint version and upgrade
octoprint --version
pip install --upgrade "OctoPrint>=1.11.8"

# Restart the service after upgrade
sudo systemctl restart octoprint