CVE-2026-53553
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client.
Risk Assessment
An attacker can read arbitrary files from the server's file system, including configuration files, private keys, and sensitive data, leading to confidentiality breach.
Recommendation
Update Goploy to version 1.18.0 or later. Additionally, restrict API access and validate file paths server-side.
Other vulnerabilities in Goploy
See all- CVE-2026-53552Critical
Goploy versions up to 1.17.5 fail to verify that a project belongs to the caller's namespace during file operations and project editing. A user with the manager role can read, write, or delete files in any project and change the git remote URL, leading to remote code execution on the next deploy.
- CVE-2026-114665Medium
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.
Original NVD description (English source)
Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS