In certain releases of Octopus Server, an attacker who has permission to upload a NuGet package can craft a malicious package and deploy a script step that runs outside the intended parent directory. This allows the script to execute with elevated scope, potentially reading, modifying, or exfiltrating files that the deployed project should not access, thereby violating confidentiality and integrity of the system. The flaw is rooted in improper path handling and privilege management during NuGet deployment, categorised as a path traversal and privilege‑escalation weakness.

The vulnerability affects Octopus Deploy’s Octopus Server product. Specific version ranges are not listed in the provided data, so any Octopus Server installation that matches the description should be considered at risk until a vendor update confirms remediation.

With a CVSS score of 5.1, the risk is moderate but not trivial. No EPSS data is available, and the vulnerability is not yet in CISA’s KEV catalog, suggesting limited public exploitation to date; however, the attack requires only the ability to upload a package, a capability that is commonly granted to developers or build engineers. If an attacker gains that permission, they can deploy a script that runs outside the parent directory, enabling broad access to the file system or network resources. Given the potential for significant impact, users should consider strong monitoring and access controls.