# OctoPrint 1.11.3 - Product: OctoPrint (https://whatsnew.fyi/product/octoprint) - Vendor: Gina Häußge - Date: 2025-09-09 - Version: 1.11.3 - Original notes: https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.3 - Permalink: https://whatsnew.fyi/product/octoprint/releases/1.11.3 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **security** — Fix RCE in OctoPrint via unsanitized filename in file upload (CVE-2025-58180), a high severity vulnerability allowing authenticated attackers to upload files under specially crafted filenames that could enable arbitrary command execution if included in system event handler commands - **security** — Remove unused and unneeded cookie setter functionality in LargeResponseHandler that could be used to break returned responses through user input - **added** — Add new CLI command to trigger the appkey request workflow via octoprint plugin appkeys:request-key - **added** — Allow configuring whether to enable shell mode on a system event hook in the Event Manager Plugin - **added** — Add new healthcheck to check for deprecated global API key being set and possibly used, disabled by default and will be enabled with 1.12.0 - **changed** — Introduce new shell parameter on type: system commands to explicitly configure whether commands should be run in a shell or directly, currently defaulting to true and changing to false in 1.13.0 - **changed** — Event Manager Plugin UI improvements - **fixed** — Fix unwanted side effect on HierarchicalChainMap._unflatten that could make it impossible to reset the run-time value of a dict-based setting back to an empty dict - **fixed** — Remove uses of the cgi module which has been deprecated and removed from Python 3.13+ - **fixed** — Add note that the global API key will be removed with the release of OctoPrint 1.13.0 - **fixed** — Pin psutil dependency to version 6.0.0 to work around a problem with its builds available on piwheels - **fixed** — Fix access request handling on newly opened page in Application Keys Plugin - **fixed** — Use proper name for filesViewModel instead of deprecated name gcodeFilesViewModel in Upload Manager Plugin - **deprecated** — Global API key is deprecated and will be removed in OctoPrint 1.13.0, users should switch to Application Keys instead

Click here if you want to help with OctoPrint's funding!

##### ✋ Heads-ups **The heads-ups from 1.11.0 still apply**, please read this release's [release notes](https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.0) as well for a full picture of what you should be aware of and what changed! ###### 🔒 Explicitly configure whether to use shell mode for your system event subscriptions OctoPrint 1.11.3 introduces a new `shell` parameter on `type: system` commands that allows to specify whether the command should be run in a shell (`true`, *currently* the default) or directly (`false`, the *future* default). Running commands in a shell has security implications as a misconfigured command with placeholders coming from external, potential untrusted sources can lead to arbitrary command execution. However, running commands in a shell also allows for more powerful scripting and also access to the shell’s environment, making it often unnecessary to set the full paths of commands that are supposed to be run. OctoPrint so far has been running system commands defined in event hooks within a shell. Starting with OctoPrint 1.11.3, OctoPrint will log a message to `octoprint.log` when it encounters a system hook that hasn’t yet explicitly configured `shell`, and default to enabling shell mode. From 1.13.0 onward, **this behaviour will change**, and OctoPrint will default to not enabling shell mode in such cases, to further reduce the attack surface. You should make an explicit decision now. Try to make your commands work without having to enable shell mode, and thoroughly vet your commands and parameter processing if you have to enable shell mode. The bundled Event Manager's UI has been adjusted to allow you to configured the `shell` parameter. ###### 🔥 Switch to Application Keys, the global API key will be removed in 1.13.0 The global API key has been deprecated for a long time now. So far the deprecation notice said it would be removed in OctoPrint 2.0, however this now has been rescheduled to OctoPrint 1.13.0. OctoPrint 1.12.0 will prepare this removal further and ship with a new health check enabled that will detect if you have a global API key set. OctoPrint 1.13.0 will then remove it altogether. Instead of using the global key you should create individual [Application Keys](https://docs.octoprint.org/en/main/bundledplugins/appkeys.html) for your third party clients. That way they get permissions matching the user account used for key creation and you can also revoke access to one app without having to change the keys for all other apps. It's also recommended to create a user account without admin access and use that for third party clients where possible. ##### ⛈ Issues while updating? On every new OctoPrint release we see some people run into the same issues with outdated or broken environments all over again. If you encounter a problem during update, please check [this collection of the most common issues](https://community.octoprint.org/t/my-octoprint-update-fails/37880) encountered over the past couple of release cycles first, and test if the included fixes solve your problem. ##### ♻ Changes ###### 🔒 Security fixes - **RCE in OctoPrint via Unsanitized Filename in File Upload**, severity High (7.5): OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler and said event gets triggered. If no event handlers executing system commands with uploaded filenames as parameters have been configured, this _[Truncated at 4000 characters — full notes: https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.3]_