This vulnerability (CWE-22) in Octopus Server enables an attacker with specific permissions to exploit a path traversal flaw. By manipulating file paths, the attacker can overwrite arbitrary files on the server filesystem. This file overwrite capability can escalate to remote code execution depending on the server configuration. The affected versions are from 2024.1.4131 up to but not including 2026.1.11725, 2026.2.0 up to but not including 2026.2.13344, and 2026.3.0 up to but not including 2026.3.11816. No known exploits in the wild have been reported. The vulnerability requires low attack complexity and no user interaction but requires privileges to modify certain external feeds.

An attacker with permission to modify non built-in external feeds can overwrite arbitrary files on the Octopus Server. This can lead to remote code execution in some configurations, potentially allowing full system compromise. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7, reflecting network attack vector, low complexity, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the input data. Until a patch is available, restrict permissions to modify external feeds to trusted users only to reduce risk.