GHSA-49wm-4fp6-h59c

OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type

Source: GitHub Advisory Database (reviewed) Low CVE-2022-2872

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	OctoPrint	< 1.8.3	1.8.3

Details

As written in the advisory (Markdown source, shown as plain text).

OctoPrint prior to version 1.8.3 is vulnerable to Unrestricted Upload of File with Dangerous Type. Due to misconfiguration in move file functionality, an attacker could easily change the file extension of an uploaded malicious file disguised as a `.gcode` file. Version 1.8.3 contains a patch.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-2872 advisory
https://github.com/octoprint/octoprint/commit/3e3c11811e216fb371a33e28412df83f9701e5b0 web
https://github.com/octoprint/octoprint package
https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2022-286.yaml web
https://huntr.dev/bounties/b966c74d-6f3f-49fe-b40a-eaf25e362c56 web