File Upload Vulnerability in Octopus Deploy by Octopus Deploy
CVE-2025-0526

2.3LOW

Key Information:

Vendor: Octopus Deploy
Status: Octopus Server
Vendor: CVE Published:; 11 February 2025

🔔 Create Octopus Deploy Vulnerability Alert

What is CVE-2025-0526?

In certain versions of Octopus Deploy, an API endpoint allows file uploads to unintended locations due to insufficient validation of input fields. This could lead to exploitation by allowing attackers to bypass standard workflows, potentially compromising the integrity and security of the host environment.

Affected Version(s)

Octopus Server Windows 2022.4.791 < 2024.3.13097

Octopus Server Windows 2024.4.401 < 2024.4.7091

References

https://advisories.octopus.com/post/2024/sa2025-03/

CVSS V4

Score:

2.3

Severity:

LOW

Confidentiality:

None

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Feb 11, 2025
Vulnerability Reserved
Jan 17, 2025

Credit

This vulnerability was found by Edward Prior (@JankhJankh)