Vulnerabilities

TI-2026-79255 CVE-2026-114665 · GHSA-q5pp-jrgg-4fpm

Symlink following in Goploy lets members read arbitrary files

LOW 31

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00353 Published 2026-10-22 Fixed in 1.18.1 CWE-59

TI-2026-38624 CVE-2026-53553 · GHSA-4g5x-hcwm-82jw

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

HIGH 67

Goploy is an open-source automation deployment system.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00465 Published 2026-08-31 Fixed in 1.18.0 CWE-200

TI-2026-38623 CVE-2026-53552 · GHSA-26rh-24rg-j3vv

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

MEDIUM 43

Goploy is an open-source automation deployment system.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.0035 Published 2026-08-31 Fixed in 1.18.0 CWE-639

Vulnerabilities

Filters

Symlink following in Goploy lets members read arbitrary files

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers