CVE-2026-0704 is a path traversal flaw in Octopus Server that lets an API endpoint remove files, or the contents of files, on the host. NVD scores it 9.1, critical, while Octopus rates it medium at 5.9. The fix is 2025.3.14715, 2025.4.10359 or later, and the latest release is 2025.4.10446.
What's affected
Octopus Deploy lists these Octopus Server versions as affected, on Windows and Linux:
- All 2023.x versions.
- All 2024.x versions.
- All 2025.1.x and 2025.2.x versions.
- 2025.3.x versions before 2025.3.14715.
Fixed releases are 2025.3.14715 and 2025.4.10359. Octopus says anyone on 2025.4.10446 or higher is not affected, and recommends upgrading to that build, which it calls the latest.
The advisory gives two severity numbers. Octopus rates the issue medium with a CVSS score of 5.9. The NVD record carries 9.1, critical, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The gap is large, so read both and decide with your own network in mind. The vendor says it knows of no public announcements or malicious use. It is not on the CISA KEV list.
How to check if you're exposed
Start with the server version. Octopus shows it in the web portal, and your install or deployment records will have it too. Compare it with the list above.
If you run Octopus in a container or from a package, check the image tag or package version the same way:
# Linux package install, example
dpkg -l | grep -i octopus
# Container, example
docker ps --format "table {{.Names}}\t{{.Image}}"
Then ask who can reach the API. The vendor text says the flaw is in an API endpoint whose field was not validated. A server that is only reachable from a trusted network is less exposed than one on the internet, but the NVD vector lists no privileges required, so do not assume a login protects you.
Finally, look at the host. Octopus runs with rights over its own folders, tasks and logs. If you see missing log, task or configuration files you did not remove, treat it as a possible sign and keep the evidence.
What to do now
- Find every Octopus Server instance you run, including test and disaster recovery copies.
- Upgrade to the latest version, 2025.4.10446, if you can. Download it from the Octopus downloads page.
- If you cannot move to the latest, upgrade within your line: 2025.3.14715 or later on the 2023.x, 2024.x, 2025.1.x, 2025.2.x and 2025.3.x lines, and 2025.4.10359 or later on 2025.4.x.
- Octopus says there is no known mitigation, so do not rely on a workaround. Limit network access to the server to the people and agents that need it while you schedule the upgrade.
- Back up the Octopus home folder and database before and after the upgrade, then check the audit log for unfamiliar API calls from before the fix.
Why it matters
The weakness is CWE-22, improper limitation of a pathname to a restricted directory, usually called path traversal. The vendor describes it plainly: a field in an API call lacked validation, so a request could point at files outside the place the feature was meant to touch, and remove them or their contents.
Deletion is a quieter harm than data theft, but it matters for a deployment server. Octopus holds release history, deployment logs and configuration for the systems it ships to. Losing those files can break a release in flight, hide evidence of what ran, or force a restore from backup at a bad moment. The CVSS vector in the NVD record rates integrity and availability impact as high and confidentiality as none, which fits that picture.
The two severity numbers in this case are a useful lesson. A vendor score reflects their view of default setups, and a record score reflects the worst case in the vector. Neither is wrong. For a tool that can deploy to production, patch to the fixed build and keep the server off untrusted networks, whichever number you prefer.
Try it yourself
A deployment tool is only as safe as the version you remember running. This demo shows how continuous monitoring catches a newly disclosed flaw in software you already installed.
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2026-0704 critical or medium?
Both numbers are in circulation. Octopus rates it medium at 5.9. The NVD record scores it 9.1, critical. Patch either way, because the fix is a normal upgrade.
Is there a workaround?
Octopus says there is no known mitigation and recommends upgrading to a fixed version.
Is it being exploited?
Octopus says it is not aware of public announcements or malicious use. The CVE is not on the CISA KEV list.
Sources
Last reviewed: 19 October 2026.
