CVE-2026-114665
MediumCVSS 6.5Summary
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.
Risk Assessment
An attacker can access sensitive data such as database configuration and SSH keys, potentially leading to further compromise of systems and infrastructure.
Recommendation
Upgrade Goploy to version 1.18.1 or later and restrict repository write access and implement path validation in the fileDiff and fileCompare endpoints.
Other vulnerabilities in Goploy
See all- CVE-2026-53552Critical
Goploy versions up to 1.17.5 fail to verify that a project belongs to the caller's namespace during file operations and project editing. A user with the manager role can read, write, or delete files in any project and change the git remote URL, leading to remote code execution on the next deploy.
- CVE-2026-53553High
Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client.
Original NVD description (English source)
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS