CVE-2026-114665
Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.
| CWE | CWE-59 |
| Vendor | zhenorzz |
| Product | goploy |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for zhenorzz goploy
Be the first to know when new medium vulnerabilities affecting zhenorzz goploy are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
zhenorzz / goploy
1.18.0 < 1.18.1
References
github.com: https://github.com/zhenorzz/goploy/commit/97a49839cc27470f4e804d985fbd2bddac085a3a github.com: https://github.com/zhenorzz/goploy/releases/tag/v1.18.1 github.com: https://github.com/zhenorzz/goploy/blob/v1.18.0/cmd/server/api/deploy/handler.go#L404-L418 github.com: https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw github.com: https://github.com/zhenorzz/goploy vulncheck.com: https://www.vulncheck.com/advisories/goploy-1.18.0-before-1.18.1-symlink-following-arbitrary-file-read-via-deploy-filediff-and-deploy-filecompare
Credits
Zachariah Mithani (AploSec)