CVE-2026-54134

CVE-2026-54134 is a second bypass of the same underlying vulnerability patched in GHSA-m9jh-jf9h-x3h2. That alone should end any debate about whether endpoint-specific fixes are sufficient. The root cause — a parsing differential between OctoPrint's Tornado upload handler and its Flask/Werkzeug request processing — is architectural. It will produce more bypasses as long as that boundary exists, because parser differential exploits across framework layers are a documented class with a lineage stretching back over a decade in comparable stacks. The four affected endpoints (/api/files/local, /api/files/sdcard, /api/languages, /plugin/backup/restore, /plugin/pluginmanager/upload_file) are not the vulnerability. They are the symptoms. The disease is the hybrid Tornado/Flask architecture layered onto a permission model that assumes FILE_UPLOAD is a narrow privilege. It isn't. Anyone with FILE_UPLOAD access can chain three impacts — treating arbitrary files as uploads, disclosing configuration secrets from accessible directories, and corrupting runtime state that survives restart. The CVSS 7 score badly misleads because it averages these compounding vectors rather than reflecting the cascade. If you maintain OctoPrint deployments: treat FILE_UPLOAD as a high-privilege permission until the architectural review completes. Audit who has it. The patch buys time, not resolution. The project's next security task is an audit of whether the Tornado upload handler is actively maintained legacy code or dead scaffolding — either way, it is a parsing surface with insufficient oversight. The long-term remediation requires either consolidating request handling to a single framework layer or instituting explicit validation at the Tornado/Flask boundary for every parameter that crosses it.

Reviewed through automated stages and approved by a human before publication.