Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Octopus Deploy: Unvalidated API Endpoint Allows File Deletion

CVE-2026-0704 · published 8 months ago
Summary

An insecure API endpoint in Octopus Deploy allowed unauthorized changes to files on a host, potentially disrupting workflows. This was due to a lack of proper validation. Octopus Deploy users should update to a fixed version to prevent unintended file deletions.

What to do
  • Update octopus octopus_server to version 2025.3.14715 or later.
Affected software
VendorProductAffected versions
octopus octopus_server >= 2023.1.4189, < 2025.3.14715
cpe:2.3:a:octopus:octopus_server:*:*:*:*:*:*:*:*
Original advisory text
In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation which could potentially result in ways ...
In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published25 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-0704 · NVD
Track software like this
Free during beta