CVE-2026-92355: Octopus Server Path Traversal Vulnerability

CVE-2026-92355 Overview

CVE-2026-92355 is a path traversal vulnerability [CWE-22] in Octopus Server. Authenticated users with permission to modify non built-in external feeds can supply crafted input that escapes the intended storage directory. The flaw allows attackers to overwrite arbitrary files on the server. In some deployment configurations, arbitrary file overwrite escalates to remote code execution on the Octopus Server host.

Critical Impact
An authenticated user with feed modification rights can overwrite server-side files and, depending on configuration, achieve remote code execution against the Octopus Server.

Affected Products

Octopus Server (affected versions per vendor advisory SA2026-09)
Deployments exposing external feed configuration to non-administrative users
Self-hosted Octopus Deploy instances with writable feed definitions

Discovery Timeline

2026-09-16 - CVE CVE-2026-92355 published to NVD
2026-09-16 - Last updated in NVD database
2026 - Octopus publishes Security Advisory SA2026-09

Technical Details for CVE-2026-92355

Vulnerability Analysis

The vulnerability resides in Octopus Server's handling of non built-in external feed definitions. When a user with feed modification permissions submits feed metadata, the server processes path-related fields without adequate normalization. Attackers can inject traversal sequences such as ../ to redirect file operations outside the intended feed directory.

Because the attacker controls both the destination path and, in relevant workflows, the file contents, the flaw enables arbitrary file overwrite on the server file system. Overwriting configuration files, scheduled task payloads, or binaries loaded by the Octopus process can produce remote code execution under the service account. The issue is network-reachable and requires only low-privileged authenticated access to feed management functionality.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Feed-related input flows into file-write operations without canonicalizing the resolved path or validating that it remains within an allow-listed base directory. Traversal characters therefore survive to the file system layer.

Attack Vector

Exploitation requires an authenticated account with permission to modify non built-in external feeds. The attacker submits crafted feed configuration values containing directory traversal sequences. When Octopus Server processes the feed, it writes attacker-controlled content to a chosen path. Where the target path corresponds to a script, plugin, or configuration file executed by Octopus, code execution follows. Refer to the Octopus Security Advisory SA2026-09 for vendor-supplied technical details.

Detection Methods for CVE-2026-92355

Indicators of Compromise

Feed definitions containing traversal sequences such as ../, ..\, or URL-encoded variants in path fields.
Unexpected file writes or modifications outside the Octopus feed storage directory performed by the Octopus Server service account.
New or modified executables, scripts, or configuration files in Octopus installation directories without a corresponding change management record.

Detection Strategies

Review Octopus audit logs for feed create and update events, correlating with the user identity and submitted field values.
Alert on file integrity changes to Octopus binaries, plugin directories, and configuration files.
Hunt for process launches spawned by the Octopus Server service that deviate from established baselines.

Monitoring Recommendations

Enable and forward Octopus Server audit logs to a centralized log platform for retention and correlation.
Monitor authentication and permission-change events for accounts granted feed modification rights.
Track outbound network connections from the Octopus Server host to detect post-exploitation command and control.

How to Mitigate CVE-2026-92355

Immediate Actions Required

Upgrade Octopus Server to the fixed version identified in Octopus Security Advisory SA2026-09.
Audit which users and teams hold permission to modify non built-in external feeds and revoke unnecessary grants.
Rotate credentials and API keys stored on the Octopus Server if compromise is suspected.

Patch Information

Octopus has released fixed builds addressed in Security Advisory SA2026-09. Administrators should apply the vendor-supplied patch to all self-hosted Octopus Server instances. Consult the advisory for exact affected and remediated version ranges.

Workarounds

Restrict the FeedEdit permission to a minimal set of trusted administrators until patching is complete.
Run the Octopus Server service under a low-privilege account with restricted file system access to limit blast radius.
Apply file system permissions that deny write access to Octopus binaries and configuration directories from the service account where feasible.

bash

# Configuration example: review users holding feed modification rights
# Run inside the Octopus Server host or via the API
curl -s -H "X-Octopus-ApiKey: $API_KEY" \
  "$OCTOPUS_URL/api/permissions/export" \
  | jq '.Permissions.FeedEdit'