CVE-2025-58180: OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
N/A
Basic Information
PythonTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| octoprint | pip | < 1.11.3 | 1.11.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability allows an authenticated attacker to achieve Remote Code Execution (RCE) by uploading a file with a specially crafted filename. The root cause is a combination of two weaknesses.
First, the sanitize_filename function in src/octoprint/util/files.py did not properly sanitize uploaded filenames, allowing characters with special meaning in shell environments (e.g., ;) to be part of the filename stored on the server. This is the entry point of the attack.
Second, when an event handler is configured to execute a system command that includes a filename placeholder, the CommandTrigger class in src/octoprint/events.py was responsible for this execution. The _processCommand method within this class would take the malicious filename and substitute it into a command template without any escaping. The resulting command string, now containing injected commands, was then executed by _executeSystemCommand using subprocess.check_call with shell=True. This shell=True argument makes the execution vulnerable to shell command injection.
The patches address both issues. Commit c3a940962f4658a8e035a00388781b1cbd768841 enhances sanitize_filename to strip dangerous characters. Commit be4201ef58d9a7c03593252398c16eada90a258b refactors the event handling logic to use shlex.quote for escaping parameters before they are used in system commands, which is the primary fix preventing the command injection.