CVE-2025-0526

In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint

Low · published February 11, 2025

CVSS v4.0
2.3
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00350 · 27.4th percentile
Published
2025-02-11T10:09Z
EPSS history
Timeline
  • 11 FEB 10:09Z
    In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint
    cvelistv5