CVE-2025-64187
📋 TL;DR
OctoPrint versions 1.11.3 and below contain a cross-site scripting (XSS) vulnerability in Action Command notifications and prompts. An attacker can craft a malicious 3D printing file that, when printed, injects HTML/JavaScript to disrupt prints, steal configuration data, or perform actions as the user. Users running vulnerable OctoPrint instances are affected.
💻 Affected Systems
- OctoPrint
📦 What is this software?
Octoprint by Octoprint
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full control of OctoPrint instance, extracts sensitive configuration data, disrupts critical prints, and performs arbitrary actions as the authenticated user.
Likely Case
Print disruption and limited information disclosure from configuration files accessible to the user's permissions.
If Mitigated
Minimal impact if OctoPrint is isolated on internal network and users only print trusted files.
🎯 Exploit Status
Exploitation requires convincing a user to print a malicious file and depends on user permissions within OctoPrint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.4
Vendor Advisory: https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-crvm-xjhm-9h29
Restart Required: Yes
Instructions:
1. Backup your OctoPrint configuration. 2. Update OctoPrint using the built-in updater or manual installation. 3. Restart the OctoPrint service.
🔧 Temporary Workarounds
Disable Action Commands
allTemporarily disable Action Command functionality to prevent exploitation.
Edit OctoPrint config.yaml and set 'enableActionCommands: false' under 'serial' section
Restrict File Uploads
allOnly allow printing from trusted sources and disable untrusted file uploads.
🧯 If You Can't Patch
- Isolate OctoPrint instance on internal network only
- Implement strict access controls and monitor for unusual print files
🔍 How to Verify
Check if Vulnerable:
Check OctoPrint version in web interface or via command line.Check Version:
python -c "import octoprint; print(octoprint.__version__)"Verify Fix Applied:
Confirm version is 1.11.4 or higher and test Action Command functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual Action Command patterns in OctoPrint logs
- Multiple failed print attempts from suspicious files
Network Indicators:
- Unexpected external connections from OctoPrint instance
SIEM Query:
source="octoprint.log" AND "Action Command" AND ("script" OR "alert" OR unusual_pattern)