PT-2025-43530 · Octoprint+1 · Octoprint+1

Published 2025-10-23 · Updated 2025-10-28 · CVE-2025-62169

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OctoPrint-SpoolManager versions 1.7.7 and older OctoPrint-SpoolManager versions 1.8.0a2 and older

Description The APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks. This allows unauthorized access to spool management functionalities. The impact is reduced when using OctoPrint version 1.11.2 and newer. The plugin is used for managing spools and their usage metadata.

Recommendations Update to OctoPrint-SpoolManager version 1.7.8 or later. Update to OctoPrint-SpoolManager version 1.8.0a3 or later. Use OctoPrint version 1.11.2 or newer to reduce the impact.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-62169

GHSA-2RRC-F24F-94F6

Affected Products

Octoprint

Octoprint-Spoolmanager

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62169.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62169 · Security Note
• https://github.com/WildRikku/OctoPrint-SpoolManager/commit/b725e113316e177ce81238a2dbbbdb63d92c40b0 · Note
• https://github.com/WildRikku/OctoPrint-SpoolManager/releases/tag/1.8.0a3 · Note
• https://github.com/WildRikku/OctoPrint-SpoolManager/releases/tag/1.7.8 · Note
• https://github.com/WildRikku/OctoPrint-SpoolManager/security/advisories/GHSA-2rrc-f24f-94f6 · Note
• https://twitter.com/cracbot/status/1983126652034109889 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1981399918251028658 · Twitter Post
• https://t.me/CVEtracker/35584 · Telegram Post
• https://twitter.com/CVEnew/status/1981395063906177390 · Twitter Post