OctoPrint released version 2.0.0rc6 on 7 October 2026. The sixth release candidate fixes regressions, older defects and plugin compatibility, and closes a path-traversal vulnerability in a file-download endpoint under limited circumstances. Because it remains a release candidate, the project recommends it only to users able to roll back and report defects.

Scope of the security fix

The changelog says an incorrect check in the download endpoint could fail to block a path-traversal pattern in certain cases. Such a defect can theoretically allow access outside the intended directory. The release note provides neither a complete exploit chain nor severity rating, so broader compromise should not be inferred; it is nevertheless the strongest reason to evaluate this update.

Security is not only a version number. OctoPrint should not be exposed directly to the public internet. A local network, patched operating system, unique authentication, suitable reverse proxy or VPN and removal of unnecessary plugins reduce exposure.

Regressions and data validation

RC6 restores support for the legacy G-code Viewer `loadFile` signature, repairing plugins that broke. It fixes caching and invalid analysis metadata on metadata upload and rejects NaN or infinite numeric values. These details can otherwise lead to bad previews, state or plugin failure in an automated print workflow.

Other fixes address the wrong PrintFailed payload, unset progress, deprecated Python `inspect.getargspec` use and version information in the logging wizard. Together they smooth internal API and dependency changes in the 2.0 branch.

What to test before upgrading

The project specifically requests testing of the web UI, serial connection, printer storage, blocked serial settings and disconnected error state. It also asks for Klipper/Moonraker and Bambu connector feedback. Record plugin names and versions because targeted compatibility fixes cannot guarantee every third-party extension.

Try a cloned or spare instance before a production machine. Back up OctoPrint configuration, plugins and user data; record OS, Python and connected firmware versions; then run a short, supervised test print. Verify the rollback route before installing the candidate.

A release candidate, not the stable major version

The RC label means the project is approaching stability while explicitly soliciting tests. The security fix creates a two-sided risk decision: an exposed or sensitive instance may favour updating, while an isolated production machine may face greater cost from RC disruption. Exposure and rollback readiness should govern the choice.

Verified fact and editorial conclusion

The 2.0.0rc6 release and fixes listed in its official changelog are verified. This article has no independent evidence of practical exploitation beyond the release note. LAYERTIMES sees RC6 as an important test for the stable 2.0 release, but production deployment requires a backup, test plan and documented rollback.