Description

A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function _validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-22T00:16:32.187Z",
  "pubdate": "2026-09-22T00:16:32.187Z",
  "executiveSummary": "A critical path traversal vulnerability has been identified within the File Download API of OctoPrint 1.0.0. This security flaw originates from insufficient sanitization of user-supplied input handled by the _validate function within the src/octoprint/server/api/files.py file.\nThe vulnerability allows a remote, unauthenticated attacker to manipulate the filename parameter to bypass intended directory restrictions. By injecting directory traversal sequences (e.g., ../), an attacker can access sensitive files residing outside the designated download directory, leading to unauthorized file disclosure.\nGiven that public exploits exist, the risk of exploitation is high. This flaw poses a severe threat to the confidentiality of system files and sensitive configuration data stored on the host operating system. Organizations utilizing this version of OctoPrint are at immediate risk of information disclosure, potentially leading to full system compromise depending on the accessible file content.",
  "technicalDetails": "The vulnerability resides in the request handling logic for file downloads, specifically within the src/octoprint/server/api/files.py source file. The _validate function, which is responsible for verifying the integrity and safety of the filename argument before the server processes the file retrieval request, fails to adequately validate or sanitize directory traversal sequences.\nThe root cause is an improper neutralization of special elements used in a file path (CWE-22). When the application receives a request to download a file, the _validate function does not enforce a canonicalization check or restrictive chroot-like behavior on the filename parameter. Consequently, the underlying file system API processes the path string literally, allowing the inclusion of parent directory references (../).\nThe exploitation flow is as follows: 1) The attacker constructs a malicious HTTP GET request targeting the File Download API endpoint. 2) The attacker injects a crafted filename argument containing traversal sequences, such as '../../../../etc/passwd'. 3) The server-side _validate function fails to detect these sequences as malicious, permitting the path to reach the backend file retrieval operation. 4) The server attempts to read the file located at the calculated path, which effectively points outside the intended storage directory.\nBecause the application treats these manipulated inputs as legitimate paths, the server reads the target file and transmits its contents back to the attacker in the HTTP response body. This attack is performed remotely and does not require complex pre-conditions beyond network reachability to the OctoPrint instance. The absence of input filtering allows for arbitrary file reading limited only by the permissions of the user account running the OctoPrint process. If the service is running with elevated privileges, the attacker could retrieve sensitive configuration files, authentication tokens, or system-level data, which significantly increases the post-exploitation impact. The vulnerability exists in OctoPrint version 1.0.0 and remains unpatched by the original vendor."
}