CVE-2026-54134: OctoPrint < 1.11.8, >= 2.0.0rc1, < 2.0.0rc3

Affected technology

OctoPrint · < 1.11.8, >= 2.0.0rc1, < 2.0.0rc3
OctoPrint

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Adjacent network · Low privileges required · No user interaction required

What an attacker can do

An attacker with FILE_UPLOAD permission can inject reserved internal upload fields through query parameters or parser differentials despite the earlier GHSA-m9jh-jf9h-x3h2 fix. Vendor/CNA’s CVSS 4.0 assessment (base score 7.0/10) rates confidentiality impact as high; integrity impact as low; availability impact as none.