CVE-2025-64187

Katalog CVE

CVSS 4.4 · Medium EPSS 0,17%

Kerentanan Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) pada octoprint. Skor CVSS 3.1 4.4 (Medium) menurut NVD.

Deskripsi (NVD)

OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. This issue is fixed in version 1.11.4.

Rincian

Terbit di NVD

7 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-crvm-xjhm-9h29 advisory vendor
• https://github.com/OctoPrint/OctoPrint/commit/9112e07b1085f4c1ee9eefc67985809251057a44 patch