CVE-2026-0704: Octopus Deploy Server path traversal in API endpoint
CVE-2026-0704 affects Octopus Deploy Server and allows files or file contents on the host to be removed through an API endpoint that lacks input validation. NVD assigns a CVSS base score of 9.1 (critical), while the CNA assigns 5.9. No confirmed exploitation appears in the sources consulted, and the record lists no fixed versions.
Overview
CVE-2026-0704 is a path traversal weakness (CWE-22) in Octopus Deploy Server. According to the record, an API endpoint lacked validation of a field, allowing files or file contents on the host to be removed. The record notes this could enable ways to circumvent expected workflows. The only vendor reference in the record is Octopus advisory SA2026-01.
Impact
- Confidentiality: the NVD vector marks confidentiality impact as none.
- Integrity and availability: the NVD vector marks both as high.
- Score difference: the CNA score of 5.9 uses a different CVSS scheme from the NVD score of 9.1. This difference is an inference and should be checked against the advisory.
Affected products and versions
- Octopus Octopus Server: from 2023.1.4189 up to before 2025.3.14715.
- Octopus Deploy Octopus Server: from 2023.0.0 up to before 2025.3.14715, and from 2025.4.0 up to before 2025.4.10359.
The record lists no fixed versions. The upper bounds above are where the listed ranges end. Whether they match fixed releases must be confirmed in the vendor advisory.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. EPSS reports a probability of 0.00378 and a percentile of 0.30568. SSVC data reports exploitation as none and automatable as no.
Remediation and mitigation
- Review the vendor advisory and confirm the fixed release for your release branch.
- Upgrade to a release outside the listed affected ranges as soon as practical.
- Until patching is complete, limit access to the Octopus Server API to trusted networks and accounts, applying least privilege.
- Keep current backups of server configuration and confirm they can be restored.
Detection guidance
- Review API access logs for requests to unexpected endpoints or unusual file-related activity on the server.
- Monitor integrity of server files and configuration directories.
- Alert on unexpected deletion or modification of files on the host.
Limitations of the available information
The record does not name the affected endpoint, does not list fixed versions, and does not describe prerequisites for exploitation. CVSS scores differ between the NVD and the CNA. Details are limited to the description and the vendor advisory link.
Frequently asked questions
Can attackers remove files through this flaw?
The record says an API endpoint lacked validation and allowed removal of files or file contents on the host. Treat this as a file integrity risk and check the vendor advisory for details.
Is this CVE being exploited in the wild?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. EPSS and SSVC data indicate low exploitation likelihood, but this is not a guarantee.
Which versions should I check?
Check the ranges from 2023.1.4189 up to before 2025.3.14715, from 2023.0.0 up to before 2025.3.14715, and from 2025.4.0 up to before 2025.4.10359. The record lists no fixed versions, so confirm the fix with the vendor.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.