Vulnerability Description
In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory.
References
FAQ
What is CVE-2026-12887?
CVE-2026-12887 is a documented vulnerability. In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory.
How severe is CVE-2026-12887?
CVSS scoring is not yet available for CVE-2026-12887. Check NVD for updates.
Is there a patch for CVE-2026-12887?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.