Description
A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument command results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-22
Score: 5.1 Medium
EPSS: 2.1% Low
KEV: No
Impact: Remote Command Execution via OS command injection
Action: Assess Impact
AI Analysis

Impact

A flaw in OctoPrint version 1.0.0 allows an attacker to craft a malicious command argument for the executeSystemCommand function within the Command API. The vulnerability permits the injection of arbitrary OS commands, giving the attacker full control over the host system where OctoPrint is running. This weakness falls under CWE-77 (Command Injection) and CWE-78 (OS Command Injection), giving the attacker potential to exfiltrate data, modify system files, or disrupt service availability.

Affected Systems

The affected system is OctoPrint 1.0.0. No other versions or variants are listed, and the vendor has not responded to the disclosure.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate risk, but the public release of the exploit and the lack of an official patch raise concern. EPSS score of 2% indicates a very low yet non‑zero probability that it will be exploited, and the vulnerability is not yet listed in the CISA KEV catalog. The attack vector is remote, requiring network access to the OctoPrint server’s API endpoint. An attacker who can reach the API can immediately execute arbitrary commands, making this a high‑impact situation for affected installations.

Generated by OpenCVE AI on September 22, 2026 at 15:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade OctoPrint to a patched release that secures the executeSystemCommand endpoint.
  • Restrict network access to the Command API endpoint using firewall rules or authentication, limiting it to a trusted administrative subnet.
  • If a newer release is unavailable, disable or remove the Command API functionality by editing OctoPrint’s configuration or installing a plugin that restricts command execution.

Generated by OpenCVE AI on September 22, 2026 at 15:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument command results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title OctoPrint Command API system.py executeSystemCommand os command injection
First Time appeared Octoprint
Octoprint octoprint
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*
Vendors & Products Octoprint
Octoprint octoprint
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Octoprint Octoprint
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-22T15:38:24.675Z

Reserved: 2026-09-21T17:45:19.608Z

Link: CVE-2026-94490

cve-icon Vulnrichment

Updated: 2026-09-22T14:49:59.262Z

cve-icon NVD

Status : Deferred

Published: 2026-09-22T00:16:32.360

Modified: 2026-09-22T19:04:55.677

Link: CVE-2026-94490

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T15:45:17Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')