Octopus Server EUVD-2026-80225

Exploitation requires a valid Octopus Server account that has been granted the specific permission to modify non built-in external feeds - this is not a default permission held by all authenticated users, so the attack surface is limited to users or roles that have been explicitly delegated this capability. The path traversal (arbitrary file write) is unconditional once that permission is held. The further escalation to remote code execution additionally requires a deployment configuration where the Octopus Server process has write access to directories containing executables, configuration files loaded at runtime, or interpreted scripts - this is not guaranteed in hardened deployments. Exploitation limits: requires authenticated access, requires the specific external feed permission to be granted, and RCE is conditional on file-system permission layout of the host. Network access to the Octopus Server web interface is required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, score 8.7) accurately reflects the core risk: network-accessible exploitation requiring only low privileges (a user account with external feed modification rights), no user interaction, and high impact across all three CIA pillars on the vulnerable system. The RCE impact is conditionally qualified ('in some configurations'), meaning the integrity impact (arbitrary file write) is unconditional, while code execution depends on deployment specifics such as service account write permissions to executable directories, presence of interpreted scripts loaded by the server process, or proximity to startup/config files. There is no EPSS data, KEV listing, or public POC available at time of analysis, which moderates urgency despite the high vendor-assessed score. However, Octopus Server instances commonly hold deployment credentials and production infrastructure access, making any compromise particularly high-consequence. The configuration-dependent RCE path does not reduce the severity of the guaranteed arbitrary file write primitive.

An attacker with a legitimate Octopus Server account that has been granted 'modify external feeds' permission crafts a feed configuration containing path traversal sequences (e.g., '../../') in a filename or path field, causing the server to write attacker-controlled content to a sensitive location such as a startup script or application plugin directory. If the Octopus Server service account has write access to executable paths, the overwritten file is subsequently loaded or executed by the server process, achieving remote code execution under the server's service identity. No public POC has been identified at time of analysis.