CVE-2026-92355
HighCVSS 8.7Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, potentially leading to remote code execution in some configurations.
Risk Assessment
Risk of remote code execution by a privileged user, potentially leading to full server compromise and system integrity violation.
Recommendation
Upgrade Octopus Server to a patched version and restrict permissions to modify external feeds to trusted users only.
Other vulnerabilities in Octopus Server
See all- CVE-2026-91778High
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker, including the built-in worker. Incorrect permission validation during script execution allowed the script to run without the user having the required authorization.
- CVE-2026-14163High
In affected versions of Octopus Server, sensitive variables may be printed in clear-text in the deployment variable snapshot under certain circumstances.
- CVE-2026-8296Medium
In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.
- CVE-2026-4881Medium
In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes using a certain API endpoint despite receiving an error.
Original NVD description (English source)
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS