CVE-2025-0526: In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked...
2.3
CVSS
Description
In affected versions of Octopus Deploy it was possible to upload files to unexpected locations on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.
Classification
CVE ID: CVE-2025-0526
CVSS Base Severity: LOW
CVSS Base Score: 2.3
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Affected Products
Vendor: Octopus Deploy
Product: Octopus Server
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.94% (scored less or equal to compared to others)
EPSS Date: 2025-03-12 (when was this score calculated)