CVE-2026-114665: Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Goployto a version that resolves this vulnerability.Fixed in 1.18.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Goploy member who also has write access to a repository can exploit it by committing a symlink that points outside the project directory.
What data could be exposed?
The issue can be used to read arbitrary files accessible to the Goploy process, including database configuration and deployment SSH private keys.
Which endpoints are involved?
The affected endpoints are /deploy/fileDiff and /deploy/fileCompare.
What versions are affected and what version fixes it?
Goploy 1.18.0 is affected. The issue is fixed in version 1.18.1.