CVE-2026-0704: Path Traversal
In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0704?
CVE-2026-0704 is considered a high severity vulnerability due to the potential for unauthorized file deletion on the host.
How do I fix CVE-2026-0704?
To fix CVE-2026-0704, update your Octopus Deploy version to at least 2025.3.14716 to ensure proper validation exists.
Which versions of Octopus Deploy are affected by CVE-2026-0704?
CVE-2026-0704 affects Octopus Deploy versions from 2023.1.4189 up to 2025.3.14715.
What type of attack does CVE-2026-0704 facilitate?
CVE-2026-0704 facilitates an attack that can allow unauthorized users to remove files and/or contents of files via an API endpoint.
Are other operating systems impacted by CVE-2026-0704?
CVE-2026-0704 specifically impacts Octopus Deploy and is not inherently linked to any operating system vulnerabilities.