A flaw in OctoPrint’s upload handling, specifically CWE-73 – External Control of File Destination, allows an attacker with FILE_UPLOAD permission to inject internal upload fields through query parameters. Because the framework parses request parameters inconsistently, the attacker can cause OctoPrint to treat an arbitrary host file as a temporary upload, move it to a publicly downloadable directory, and disclose configuration secrets or other readable files. The attacker can also delete runtime files, potentially disrupting future restarts. This issue leads to unauthorized information disclosure and file manipulation rather than arbitrary code execution.

Affected versions are all releases of OctoPrint prior to 1.11.8 and 2.0.0rc3. The vulnerability exists in the endpoints /api/files/{local|sdcard}, /api/languages, /plugin/backup/restore, and /plugin/pluginmanager/upload_file. Any deployment running one of these older versions is vulnerable, regardless of the printing firmware. The fix is available in OctoPrint 1.11.8 and OctoPrint 2.0.0rc3.

The CVSS score of 7 indicates a moderate severity. The EPSS score is not available, and the vulnerability has not been listed in CISA KEV. The likely attack vector is through the web interface; an attacker can send crafted HTTP requests to the vulnerable upload endpoints. The presence of the FILE_UPLOAD permission requirement means that the attacker must possess a user account with that privilege. Once the exploit is successful, the attacker can exfiltrate or delete files, compromising confidentiality and possibly affecting service availability.