Description
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Octopus Deploy | Octopus Server | 2024.1.4131 – < 2026.1.11725, 2026.2.0 – < 2026.2.13344, 2026.3.0 – < 2026.3.11816 | 2026.1.11725 |
Advisories 1
- WID-SEC-2026-3374 Octopus Deploy: Schwachstelle ermöglicht Manipulation von Dateien und potenziell Codeausführung BSI CERT-Bund (WID) · Sep 15, 2026