# OctoPrint 2.0.0rc3 - Product: OctoPrint (https://whatsnew.fyi/product/octoprint) - Vendor: Gina Häußge - Date: 2026-06-23 - Version: 2.0.0rc3 - Original notes: https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3 - Permalink: https://whatsnew.fyi/product/octoprint/releases/2.0.0rc3 - Labels: Pre-release What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **security** — Fix XSS in Suppressed Command Notifications allowing injection of arbitrary HTML and JavaScript into notifications - **security** — Fix file exfiltration vulnerability via parameter injection on upload endpoints - **added** — Add the used printer connector to various printer related events - **added** — Add support for hiding non-stock marks on the temperature graph - **added** — Add Printing chart marker showing start of actual job processing after initial preheating and leveling - **added** — Add more filter options to the plugin repository browser to filter out commercial or AI developed plugins - **added** — Add display of the ai-developed attribute in the plugin repository - **fixed** — Fix Hide successfully printed files option in the file list breaking its processing due to JS errors inside the filter - **fixed** — Fix /api/job throwing an error in case of a non-int progress - **fixed** — Fix crash in Printer.get_current_temperatures when printer connector doesn't support temperature offsets - **fixed** — Fix download filenames containing a comma - **fixed** — Fix stopping and starting of analysis queue - **changed** — Update gcode-thumbnail-tool to fix extraction of thumbnails generated by Creality Print 7.x - **fixed** — Fix versioning without available tags

Click here if you want to help with OctoPrint's funding!

###### ⚠️ Important note on release candidates This is a **R**elease **C**andidate of OctoPrint. It is not a stable release: severe bugs can occur, and they can be bad enough that they make a manual downgrade to an earlier version necessary - maybe even from the command line. You should be comfortable with and capable of possibly having to do this before installing an RC. ###### 🔁 Feedback on this RC Please provide *general* feedback on this RC [in this ticket](https://github.com/OctoPrint/OctoPrint/issues/5423). An "All is working fine" is valuable feedback as well because it tells me people are actually testing this RC and just not finding problems with it. **If you run into any obvious bugs, please follow ["How to file a bug report"](https://github.com/OctoPrint/OctoPrint/blob/master/CONTRIBUTING.md#how-to-file-a-bug-report)** - I need logs and reproduction steps to fix issues, not just the information that something doesn't work. Thanks! ###### Things to take a closer look at For this RC, these things should get a closer look while testing, if possible: 1. proper behaviour when using the included web interface as well as any third party clients at your disposal 2. printing via a serial connection 3. managing files on your printer's storage via a serial connection 4. blocklisted serial ports and/or baud rates are properly migrated to the serial connector (one per line, *not* comma-separated) 5. if your printer's disconnected state happens to be "after error", please report back on which connector you used and what the reported error is 6. if you have a Klipper/Moonraker based printer available: can you use it through OctoPrint when you install the [Moonraker Connector](https://github.com/OctoPrint/OctoPrint-MoonrakerConnector)? 7. if you have a Bambu based printer available: can you use it through OctoPrint when you install the [Bambu Connector](https://github.com/OctoPrint/OctoPrint-BambuConnector)? ###### ✋ Heads-ups [The heads-ups from 2.0.0rc1 still apply!](https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc1) ###### 🔒 Security fixes - **XSS in Suppressed Command Notifications**, severity Moderate (4.6): OctoPrint versions up to and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Suppressed Command notifications popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. See also the [GitHub Security Advisory](https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h) and [CVE-2026-35163](https://nvd.nist.gov/vuln/detail/CVE-2026-35163). - **File exfiltration possible via further parameter injection on upload endpoints**, severity High (7.0): OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the `FILE_UPLOAD` permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be downloaded from. This vulnerability was already reported as [GHSA-m9jh-jf9h-x3h2/CVE-2025-48067](https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-m9jh-jf9h-x3h2) but the fix provided in OctoPrint 1.11.2 turned out to be incomplete. The primary risk lies in the potential e _[Truncated at 4000 characters — full notes: https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3]_