CVE-2026-53553

Name of the Vulnerable Software and Affected Versions Goploy versions prior to 1.17.6

Description Goploy is an open-source automation deployment system. A path traversal issue exists in the /deploy/fileDiff endpoint due to insufficient validation and sanitization of the filePath parameter. This allows an attacker to use directory traversal sequences like ../ to read arbitrary files from two locations: the local host where Goploy is running (returned in the srcText field) and any remote server managed by the system (returned in the distText field) via the SFTP protocol. The issue is easily exploitable because the default member role is granted the File Compare permission. An attacker with low-privileged user access can bypass restrictions by specifying a namespace header such as G-N-ID and enumerating the serverId variable to access sensitive files across all managed target servers.

Recommendations For versions prior to 1.17.6, strictly filter special characters such as ../, .., and %00 in file path inputs. Use filepath.Clean to format paths and verify that the resulting absolute path is within a legitimate restricted directory or sandbox. Run the Goploy service using a low-privileged user identity to limit access to sensitive system files. Restrict access to the /deploy/fileDiff endpoint to only highly trusted users. As a temporary mitigation, restrict the use of the filePath parameter in the /deploy/fileDiff endpoint until a patch is applied.