An API endpoint in Octopus Server lacks proper input validation, enabling an actor with access to the endpoint to delete files or overwrite the contents of files on the host system. The flaw allows removal or modification of any file that the Octopus process can write to, potentially bypassing intended operational workflows.

Octopus Deploy Octopus Server. The vulnerability applies to any deployed instance of this product; the specific affected versions are not disclosed in the advisory.

The CVSS score of 5.9 denotes medium severity, and the EPSS score of less than 1 % indicates a very low probability of active exploitation in the field. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to reach the Octopus Server API endpoint; after reaching that endpoint the lack of path validation permits deletion of any file residing on the host under the Octopus process’s permissions.