CVE-2025-64187 - CVE House
Back to Database
Status published Medium CVE-2025-64187

OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts

Vulnerability Description

OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. This issue is fixed in version 1.11.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64187

Credits & Attribution

No credits recorded in the NVD database.

References

More from OctoPrint

View All →
CVE-2025-58180
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
High 7.5
CVE-2025-48879
OctoPrint Vulnerable to Denial of Service through malformed HTTP request
Medium 6.5
CVE-2025-48067
OctoPrint vulnerable to possible file extraction via upload endpoints
Medium 5.4
CVE-2025-32788
OctoPrint Authenticated Reverse Proxy Page Authentication Bypass
Medium 4.3
CVE-2024-51493
API key access in settings without reauthentication in OctoPrint
Medium 5.3

Affected Vendor

Affected Software

OctoPrint
Vulnerable Versions:
< 1.11.4

Timeline

Official Publish: November 7th, 2025
Last Modified: November 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-80

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1552 Unsecured Credentials
Credential Access
T1071 Application Layer Protocol
Command and Control
T1565 Data Manipulation
Impact