CVE-2018-18850

—

CVSS 3.0

8.8 high

EPSS

12%p96

Published

Oct 31, 2018 (Oct 31, 2018)

Modified

Jun 17, 2026

Description

In Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment processes could upload a maliciously crafted YAML configuration, potentially allowing for remote execution of arbitrary code, running in the same context as the Octopus Server (for self-hosted installations by default, SYSTEM).

Vendors: octopus
Products: octopus server
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (12.5%)

In the news0 stories

No ingested article mentions this CVE yet.