Skip to content
OpenAdvisories
Medium · 5.6 CVE-2026-8296 EUVD-2026-38000GHSA-vwwv-2j8q-wf75

In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.

Published Jun 19, 2026 · Updated Jun 22, 2026 · Assigned by Octopus

Vendor: Octopus Deploy Product: Octopus Server

Description

In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.

Affected products

VendorProductAffectedFixed
Octopus Deploy Octopus Server 2023.0.0 – < 2025.4.10678, 2026.1.0 – < 2026.1.11451, 2026.2.0 – < 2026.2.13114 2025.4.10678

Advisories 1

References