In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Octopus_server | Octopus | 2023.1.4189 (including) | 2025.3.14715 (excluding) |