Path Traversal in Octopus Deploy Server

CVE-2026-92355

In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution.

Vulnerability class: Path Traversal (Directory Traversal)

Affected products

Weakness classification (CWE)

References