{"id":"CVE-2026-12887","published":"2026-10-27T14:17:00.590","lastModified":"2026-10-27T15:08:50.630","description":"In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://advisories.octopus.com/post/2026/sa2026-14/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}