CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2021-32560
Medium (6.5) in octoprint octoprint. EPSS 1.5% chance of exploitation in the next 30 days. Fixed in octoprint 1.6.0.
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- octoprint:octoprint
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x9rq-fjp5-qgm9 | PyPI | octoprint | <1.6.0 | 1.6.0 |
| PYSEC-2021-29 | PyPI | octoprint | <1.6.0 | 1.6.0 |
References
- https://github.com/OctoPrint/OctoPrint/releases/tag/1.6.0
- https://octoprint.org/blog/2021/04/27/new-release-1.6.0/
- https://www.brzozowski.io/web-applications/2021/05/11/the-insecure-story-of-octoprint.html
- https://github.com/OctoPrint/OctoPrint/releases/tag/1.6.0
- https://octoprint.org/blog/2021/04/27/new-release-1.6.0/