PT-2025-17558 · Octoprint · Octoprint

Jacopotediosi · Published 2025-04-22 · Updated 2025-04-22 · CVE-2025-32788

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OctoPrint versions up to and including 1.10.3

Description OctoPrint provides a web interface for controlling consumer 3D printers. The issue allows an attacker to bypass the login redirect and directly access the rendered HTML of certain frontend pages. The primary risk lies in potential future modifications to the codebase that might incorrectly rely on the vulnerable internal functions for authentication checks, leading to security issues.

Recommendations For versions up to and including 1.10.3, update to version 1.11.0 to resolve the issue.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-32788

GHSA-QW93-H6PF-226X

PYSEC-2025-56

Affected Products

Octoprint

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32788.json · Exploit
• https://github.com/OctoPrint/OctoPrint/commit/41ff431014edfa18ca1a01897b10463934dc7fc2 · Patch
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-qw93-h6pf-226x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32788 · Security Note
• https://osv.dev/vulnerability/GHSA-qw93-h6pf-226x · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-56 · Vendor Advisory
• https://github.com/OctoPrint/OctoPrint · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2025-56.yaml · Note
• https://twitter.com/CVEnew/status/1914734353277473079 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1914795293603762522 · Twitter Post
• https://t.me/cvetracker/22144 · Telegram Post