Live › vulnerability › CVE-2026-12887
Go to dashboardA user who is allowed to upload NuGet packages to Octopus Server can craft one that makes a deployment script step run outside its parent directory. The sources do not say what files or hosts are then reachable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Teams running self-hosted Octopus Server where some users can upload NuGet packages and deployments run script steps from them. Installations where only trusted staff can upload packages face lower risk. The sources do not say more.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-12887")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.