CVE-2023-41047

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An attacker might use this to extract data managed by OctoPrint, or manipulate data managed by OctoPrint, as well as execute arbitrary commands with the rights of the OctoPrint process on the server system. OctoPrint versions from 1.9.3 onward have been patched. Administrators of OctoPrint instances are advised to make sure they can trust all other administrators on their instance and to also not blindly configure arbitrary GCODE scripts found online or provided to them by third parties.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1336

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-410485.4plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions CVE-2023-410496.1@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in CVE-2023-41054.3Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and downloa CVE-2023-410507.7AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format s CVE-2023-410514.7In a typical Virtual Machine Monitor (VMM) there are several components, such as boot loader, virtual device drivers, virtio backend drivers CVE-2023-410525.3Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256 CVE-2023-410533.3Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant CVE-2023-410549.1LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side R CVE-2023-410557.5LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side R CVE-2023-410568.1Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overf CVE-2023-410575.5hyper-bump-it is a command line tool for updating the version in project files.`hyper-bump-it` reads a file glob pattern from the configurat CVE-2023-410587.5Parse Server is an open source backend server. In affected versions the Parse Cloud trigger `beforeFind` is not invoked in certain condition