CVE-2026-114665
HIGH
7,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Description
AI Translation Available
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.
59
Improper Link Resolution Before File Access ('Link Following')
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Access Control
Other
Potential Impacts:
Read Files Or Directories
Modify Files Or Directories
Bypass Protection Mechanism
Execute Unauthorized Code Or Commands
Applicable Platforms
Operating Systems:
Windows, Unix
https://github.com/zhenorzz/goploy
https://github.com/zhenorzz/goploy/blob/v1.18.0/cmd/server/api/deploy/handler.g…
https://github.com/zhenorzz/goploy/commit/97a49839cc27470f4e804d985fbd2bddac085…
https://github.com/zhenorzz/goploy/releases/tag/v1.18.1
https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw
https://www.vulncheck.com/advisories/goploy-1.18.0-before-1.18.1-symlink-follow…