CVE-2026-12887 in Octopus Server
Summary
by MITRE • 10/27/2026
In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability in question represents a critical path traversal and arbitrary file write issue within the deployment orchestration capabilities of affected versions of Octopus Server. This flaw specifically targets users who possess permissions to upload NuGet packages, which are commonly used for distributing software components and scripts in .NET ecosystems. The core technical deficiency lies in how the server processes package contents during the extraction phase prior to script execution. Instead of strictly validating that file paths within the archive remain confined to a designated parent directory or sandboxed environment, the application fails to adequately sanitize relative path sequences such as dot-dot-slash characters. This oversight allows an attacker to construct a malicious NuGet package containing files with traversal-based filenames that reference locations outside the intended deployment scope.
When a user initiates a deployment using this compromised package, Octopus Server extracts the archive contents without enforcing strict directory confinement rules. Consequently, script steps embedded within the package are written directly to arbitrary file system paths on the server hosting the application or its workers. This behavior effectively bypasses the security boundaries designed to isolate tenant deployments and prevent cross-tenant interference or unauthorized access to sensitive system areas. The ability to write files outside the parent directory transforms a standard deployment action into a mechanism for persistent code execution in unintended locations, potentially leading to full server compromise if combined with other exploitation techniques such as scheduled task creation or service replacement.
The operational impact of this vulnerability is severe, particularly in multi-tenant environments where trust boundaries are critical. An authenticated attacker can leverage this flaw to execute arbitrary commands on the underlying operating system by placing malicious scripts in directories that are monitored and executed by background services or deployment workers. This capability undermines the integrity of the entire CI/CD pipeline managed by Octopus Server. Furthermore, because NuGet packages are often treated as trusted artifacts once uploaded by authorized users, this vulnerability exploits a chain of trust that assumes package contents will not contain malicious path manipulations. The lack of input validation on archive entries allows for stealthy persistence mechanisms to be established without triggering typical intrusion detection alerts associated with direct command injection attempts.
From an industry standard perspective, this flaw aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-94: Improper Control of Generation of Code (Code Injection). The attack vector is consistent with MITRE ATT&CK techniques involving file system discovery and persistence through scheduled tasks or service modifications, depending on the specific paths targeted by the attacker. Defense in Depth strategies are essential here, as relying solely on application-level validation proved insufficient due to the parsing logic error within the package extraction routine.
Mitigation requires immediate patching of Octopus Server to versions that include fixes for this path traversal issue. Administrators should also enforce strict least-privilege principles regarding who can upload packages and deploy scripts, ensuring that only highly trusted individuals have these permissions. Additionally, implementing file integrity monitoring on deployment directories and worker nodes can help detect unauthorized file creations resulting from such exploits. Network segmentation between the Octopus Server components and critical infrastructure further limits the blast radius should an attacker succeed in writing malicious files to unintended locations. Regular auditing of uploaded packages for suspicious archive structures is also recommended as a supplementary control measure until all systems are updated.