PT-2025-45116 · Octoprint · Octoprint

Published 2025-11-04 · Updated 2025-11-07 · CVE-2025-64187

Positive Technologies (AI Summary)

CVSS v4.0

4.6

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions OctoPrint versions 1.11.3 and below

Description OctoPrint, a web interface for controlling 3D printers, is affected by an issue that allows the injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups. An attacker could exploit this by convincing a victim to print a specially crafted file, potentially disrupting prints or extracting information, including sensitive configuration settings if the user has the necessary permissions. The issue affects the web interface and could allow an attacker to perform actions on behalf of the targeted user within the OctoPrint instance.

Recommendations Update to version 1.11.4 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2025-64187

GHSA-CRVM-XJHM-9H29

Affected Products

Octoprint

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64187.json · Exploit
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-crvm-xjhm-9h29 · Vendor Advisory
• https://github.com/OctoPrint/OctoPrint/commit/9112e07b1085f4c1ee9eefc67985809251057a44 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-64187 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64187 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-crvm-xjhm-9h29 · Vendor Advisory
• https://github.com/OctoPrint/OctoPrint · Note
• https://reddit.com/r/VulnMatter/comments/1op46de/resumen_diario_de_vulnerabilidades_05112025 · Reddit Post
• https://t.me/CVEtracker/36738 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1986667394249424981 · Twitter Post
• https://twitter.com/CVEnew/status/1986651575612543126 · Twitter Post
• https://t.me/cveNotify/142057 · Telegram Post