CVE-2026-114665

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.

Goploy System Arbitrary File Read Vulnerability

Basic Information

• Vulnerability Name: Goploy Endpoints Arbitrary File Read via Path Traversal
• Affected Product: Goploy
• Known Affected Versions: <=1.17.5

Vulnerability Description

Goploy is an open-source automation deployment system. A severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client.

The original logic of this endpoint is to read a local project file and compare it with a file on a remote target server. However, due to insufficient validation and sanitization of the filePath parameter, and the lack of security constraints on the final absolute file path, malicious paths containing ../ are directly executed within the system.

This leads to a dual arbitrary file read issue:

1. Local Host File Read: os.ReadFile is tricked by the directory traversal payload to read any file via its absolute path on the Goploy local host (returned in the srcText field of the response body).
2. Remote Controlled Server File Read: Subsequently, the same payload is utilized via the SFTP protocol on the target server pointed to by the serverID. Influenced similarly by the directory traversal, it reads any file on the configured remote server (returned in the distText field of the response body).

The threshold for exploiting this vulnerability is extremely low, and the conditions are very easily met. The system comes with a built-in member role upon default installation, which is granted the "File Compare" permission by default. This means that as long as a normal low-privileged user is added to the system, they inherently possess the basic privileges required to call the vulnerable endpoint. The only prerequisite for the attack is that at least one project and one associated server are configured in the system.

An attacker only needs to specify the correct namespace header (e.g., G-N-ID: 1) via a packet capture tool to bypass simple restrictions. By enumerating available serverId parameters, the attacker can successfully execute path traversal via this endpoint, reading arbitrary files on both the local Goploy host and all remote target servers managed by Goploy.

Steps to Reproduce (Proof of Concept)

Theoretical Steps (See concrete steps below)

1. Obtain Normal User Privileges Log in to the system using any registered low-privileged account to obtain valid authentication credentials (Cookie/Token) and its corresponding authorized Namespace ID.

2. Construct Malicious Request Send a POST request containing the directory traversal characters ../ to the target endpoint /deploy/fileDiff, while including the G-N-ID header.

   PoC Example (Reading /etc/passwd and enumerating serverId):

   curl -s -X POST -b "goploy_token=<valid_cookie>" \
        -H "Content-Type: application/json" \
        -H "G-N-ID: 1" \
        -d '{"projectId":1,"serverId":1,"filePath":"../../../../../../../../../../etc/passwd"}' \
        "http://<target-host>/deploy/fileDiff"
   

3. Reproduction Result The server will return the complete contents of the /etc/passwd file from both the host and the remote server.

Concrete Steps

1. Environment Setup Published an arbitrary project using the super admin account:

   <img width="1919" height="428" alt="image" src="https://github.com/user-attachments/assets/8618a038-9088-45b4-804a-5541e243c6a8" />

   Configured two managed remote servers:

   <img width="1896" height="399" alt="image-1(1)" src="https://github.com/user-attachments/assets/89cfa086-d20b-448e-9cf7-1af5798e3cfe" />

   Created a normal user and assigned the member role (which includes File Compare permission):

   <img width="1910" height="343" alt="image-2"…

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy