CVE-2026-94489: OctoPrint Path Traversal Vulnerability

CVE-2026-94489 Overview

CVE-2026-94489 is a path traversal vulnerability in OctoPrint 1.0.0. The flaw resides in the _validate function of src/octoprint/server/api/files.py, which is part of the File Download API component. An authenticated remote attacker can manipulate the filename argument to escape the intended directory and access files outside the expected path. According to the disclosure, a public exploit exists and the vendor did not respond to disclosure attempts. The issue is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated remote attackers can read files outside the intended download directory by manipulating the filename parameter, potentially exposing configuration data and print job metadata.

Affected Products

OctoPrint 1.0.0
Component: File Download API (src/octoprint/server/api/files.py)
Function: _validate

Discovery Timeline

2026-09-22 - CVE-2026-94489 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94489

Vulnerability Analysis

The vulnerability affects the _validate function in OctoPrint's file handling code. This function is responsible for validating file references before serving them through the File Download API. Improper validation of the filename argument allows an attacker to inject path traversal sequences such as ../ to reach files outside the designated uploads directory.

Exploitation requires network access to the OctoPrint web interface and low-privilege authentication. No user interaction is needed. The scope of the disclosure indicates limited confidentiality impact, with no direct effect on integrity or availability. However, exposed configuration files or credentials could enable follow-on attacks against the print server or connected devices.

Root Cause

The root cause is missing or insufficient canonicalization of the filename argument in _validate. When user-supplied input is concatenated with a base directory without normalizing path separators and traversal sequences, the resolved path can point outside the intended root. This is a classic instance of [CWE-22].

Attack Vector

An attacker sends a crafted request to the File Download API endpoint containing traversal sequences in the filename parameter. Because the vulnerability is network-reachable and requires only low privileges, any account with API access to file operations can trigger the flaw. The vulnerability mechanism is documented in the VulDB entry for CVE-2026-94489. No verified proof-of-concept code is reproduced here; see the VulDB vulnerability record #408189 for additional technical details.

Detection Methods for CVE-2026-94489

Indicators of Compromise

HTTP requests to OctoPrint file API endpoints containing ../, ..\, or URL-encoded variants (%2e%2e%2f) in the filename parameter
Web server access logs showing unusual file names referencing paths outside the standard OctoPrint uploads directory
Unexpected access to configuration files such as config.yaml or user database files via the download API

Detection Strategies

Deploy web application firewall rules that block path traversal patterns in query parameters targeting /api/files/ endpoints
Monitor OctoPrint application logs for _validate errors or requests that resolve to paths outside the configured uploads folder
Correlate authenticated API sessions with anomalous file download activity to identify credential misuse

Monitoring Recommendations

Enable verbose HTTP request logging on the OctoPrint reverse proxy and forward logs to a centralized SIEM
Alert on repeated 200-OK responses to file download requests containing traversal characters
Track successful downloads of files with extensions not typically served by OctoPrint (.yaml, .cfg, .db, .log)

How to Mitigate CVE-2026-94489

Immediate Actions Required

Restrict network exposure of OctoPrint 1.0.0 instances by placing them behind a VPN or authenticated reverse proxy
Audit user accounts and revoke API access for accounts that do not require file operations
Review OctoPrint access logs for prior exploitation attempts using traversal sequences

Patch Information

No vendor patch has been referenced in the disclosure. VulDB notes that the vendor was contacted early but did not respond. Administrators should track upstream commits in the OctoPrint project and apply any subsequent security release. Consult the VulDB advisory for updated remediation guidance.

Workarounds

Place OctoPrint behind a reverse proxy that normalizes URL paths and strips traversal sequences before forwarding requests
Configure filesystem-level permissions so the OctoPrint process cannot read files outside its uploads directory
Disable or firewall the file download API endpoint if it is not required for operational workflows

bash

# Example nginx reverse proxy rule to block traversal sequences
location /api/files/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    proxy_pass http://127.0.0.1:5000;
}