Goploy versions up to and including 1.17.5 contain a path traversal vulnerability (CWE-22) in the /deploy/fileDiff API endpoint. The endpoint reads files locally and remotely via SFTP based on a client-supplied filePath parameter, which lacks proper sanitization. Attackers with low-privileged user accounts (member role with File Compare permission) can supply directory traversal payloads (e.g., ../../../../etc/passwd) to read arbitrary files on both the local host and remote servers managed by Goploy. The vulnerability is exploitable with minimal prerequisites: a normal user account and at least one configured project and server. The vulnerability has a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact.

Successful exploitation allows an attacker with low-privileged user access to read any file on the local Goploy host and all remote servers managed by Goploy. This can lead to disclosure of sensitive information, potentially facilitating further attacks or system compromise. The vulnerability does not directly allow code execution or denial of service but severely impacts confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to prevent untrusted users from accessing the File Compare feature. Monitor for unusual access patterns to the /deploy/fileDiff endpoint and consider network-level controls to limit access to trusted users only.