CVE-2021-32560: Insecure Access Control in OctoPrint
Summary
CVE-2021-32560: The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files. Affects octoprint versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OctoPrint is an open-source web interface for 3D printers that allows users to remotely control and monitor their printing process. It provides a range of features such as file management, job scheduling, and real-time monitoring. However, OctoPrint versions prior to 1.6.0 are vulnerable to an insecure access control issue in the Logging subsystem. This vulnerability arises from the mishandling of files that are not *.log files, leading to incorrect access control.
Vulnerability Detail
The Logging subsystem in OctoPrint attempts to manage files that do not have the *.log extension, which results in incorrect access control. This vulnerability could allow an attacker to gain unauthorized access to sensitive files or perform unauthorized actions within the system. The impact of this vulnerability may vary depending on the specific files and actions involved. It is important to note that this vulnerability has been addressed in OctoPrint version 1.6.0.
How To Fix
Latest published version: 1.11.8 as of 22 Oct 2026
pip install --upgrade "octoprint==1.11.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.0
This is the first release that contains the fix.
pip install --upgrade "octoprint==1.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected files by adjusting file permissions or implementing access control measures at the operating system level. However, this workaround may not provide complete protection and should be considered a temporary solution until the software is updated to a secure version.
Conclusion
In summary, OctoPrint versions prior to 1.6.0 are vulnerable to an insecure access control issue in the Logging subsystem. This vulnerability can be mitigated by updating OctoPrint to version 1.6.0 or later. It is important to promptly apply the necessary updates to ensure the security of the system. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for octoprint →
FAQ
OctoPrint is an open-source web interface for 3D printers that allows users to remotely control and monitor their printing process.
This vulnerability could allow an attacker to gain unauthorized access to sensitive files or perform unauthorized actions within the system.
Yes, this vulnerability has been addressed in OctoPrint version 1.6.0.
To fix this vulnerability, it is recommended to update OctoPrint to version 1.6.0 or later.
As a temporary workaround, users can restrict access to the affected files by adjusting file permissions or implementing access control measures at the operating system level.
Related vulnerabilities
Recent vulnerabilities recorded for octoprint.
