CVE-2026-53553

HighCVSS 7.7

Published: 31/08/2026(UTC)Updated: 31/08/2026(UTC)Translated: 01/09/2026(UTC)NVD NIST

Summary

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client.

Risk Assessment

An attacker can read arbitrary files from the server's file system, including configuration files, private keys, and sensitive data, leading to confidentiality breach.

Recommendation

Update Goploy to version 1.18.0 or later. Additionally, restrict API access and validate file paths server-side.

Other vulnerabilities in Goploy

CVE-2026-53552Critical
Goploy versions up to 1.17.5 fail to verify that a project belongs to the caller's namespace during file operations and project editing. A user with the manager role can read, write, or delete files in any project and change the git remote URL, leading to remote code execution on the next deploy.

Original NVD description (English source)