CVE-2026-12887
CVE-2026-12887
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory.
CVSS 5.1 · Medium · Fix available
- Published
- Updated
Affected products and versions
octopus server
- Versions
- ≥ 2023.0.0, < 2026.1.674: Affected (custom)
- ≥ 2026.1, < 2026.1.674: Affected (custom)
- ≥ 2026.2, < 2026.2.973: Affected (custom)
- ≥ 2026.3, < 2026.3.5839: Affected (custom)
Update to 2026.1.674; Update to 2026.2.973; Update to 2026.3.5839