CVE-2025-0526: In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation…

PriorityP431medium5.4CVSS 3.1

AVNACLPRLUINSUCNILAL

EPSS

0.32%

24.0th percentile

In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
octopus	octopus_server	>= 2022.4.791 < 2024.3.13097	2024.3.13097
octopus	octopus_server	>= 2024.4.401 < 2024.4.7091	2024.4.7091
octopus_deploy	octopus_server	>= 2022.4.791 < 2024.3.13097	2024.3.13097
octopus_deploy	octopus_server	>= 2024.4.401 < 2024.4.7091	2024.4.7091

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

nvdv4.02.3LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.