Goploy · Goploy · CVE-2026-53553
**Name of the Vulnerable Software and Affected Versions**
Goploy versions prior to 1.17.6
**Description**
Goploy is an open-source automation deployment system. A path traversal issue exists in the `/deploy/fileDiff` endpoint due to insufficient validation and sanitization of the `filePath` parameter. This allows an attacker to use directory traversal sequences like `../` to read arbitrary files from two locations: the local host where Goploy is running (returned in the `srcText` field) and any remote server managed by the system (returned in the `distText` field) via the SFTP protocol. The issue is easily exploitable because the default `member` role is granted the File Compare permission. An attacker with low-privileged user access can bypass restrictions by specifying a namespace header such as `G-N-ID` and enumerating the `serverId` variable to access sensitive files across all managed target servers.
**Recommendations**
For versions prior to 1.17.6, strictly filter special characters such as `../`, `..`, and `%00` in file path inputs.
Use `filepath.Clean` to format paths and verify that the resulting absolute path is within a legitimate restricted directory or sandbox.
Run the Goploy service using a low-privileged user identity to limit access to sensitive system files.
Restrict access to the `/deploy/fileDiff` endpoint to only highly trusted users.
As a temporary mitigation, restrict the use of the `filePath` parameter in the `/deploy/fileDiff` endpoint until a patch is applied.