Eagleshadow

**Name of the Vulnerable Software and Affected Versions** OctoPrint version 1.0.0 **Description** An OS command injection flaw exists in the Command API component within the `executeSystemCommand()` function of the `src/octoprint/server/api/system.py` file. A remote attacker can exploit this by manipulating the `command` argument to execute arbitrary operating system commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `executeSystemCommand()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OctoPrint version 1.0.0 **Description** A path traversal issue exists in the File Download API component within the ` validate()` function of the `src/octoprint/server/api/files.py` file. A remote attacker can manipulate the `filename` argument to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the ` validate()` function in the File Download API to minimize the risk of exploitation.