Detections
Analytics

SCA: security update for octoprint (GHSA-49mj-x8jp-qvfc)

high Tenable Cloud Security Plugin ID 435243

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and
 including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a
 specially crafted filename that will allow arbitrary command execution if said filename becomes included
 in a command defined in a system event handler and said event gets triggered. If no event handlers
 executing system commands with uploaded filenames as parameters have been configured, this vulnerability
 does not have an impact. The vulnerability is patched in version 1.11.3. As a workaround, OctoPrint
 administrators who have event handlers configured that include any kind of filename based placeholders
 should disable those by setting their `enabled` property to `False` or unchecking the "Enabled" checkbox
 in the GUI based Event Manager. Alternatively, OctoPrint administrators should set
 `feature.enforceReallyUniversalFilenames` to `true` in `config.yaml` and restart OctoPrint, then vet the
 existing uploads and make sure to delete any suspicious looking files. As always, OctoPrint administrators
 are advised to not expose OctoPrint on hostile networks like the public internet, and to vet who has
 access to their instance. (CVE-2025-58180)

See Also

https://github.com/advisories/GHSA-49mj-x8jp-qvfc

Plugin Details

Severity: High

ID: 435243

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 9/10/2025

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.88

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-58180

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.5

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/9/2025

Vulnerability Publication Date: 9/9/2025

Reference Information

CVE: CVE-2025-58180

cwe: CWE-78