Octopus Server contains a path traversal flaw that an attacker can exploit if they have permission to modify non built‑in external feeds. By providing a crafted feed name that includes directory references, the attacker can trick the system into writing files to arbitrary locations, potentially overwriting executables or scripts and enabling remote code execution. This flaw directly compromises confidentiality, integrity, and availability of the affected server.

The vulnerability affects Octopus Deploy's Octopus Server. Affected product versions are not specified in the advisory, so administrators should verify whether their deployed Octopus Server instances meet the conditions described. Administrators should review the latest Octopus Server releases for a fix.

The CVSS score of 8.7 classifies the flaw as High severity. The EPSS score is less than 1 %, suggesting low current exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector requires the attacker to have permission to modify external feeds, which is a privileged capability. If such permission is granted, the pathway to execute arbitrary code is direct via file overwrite, making the risk significant should an attacker obtain feed modification rights.