Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise (CVE-2026-53553)
Goploy, an open-source automation deployment system, contains a high-severity path traversal vulnerability in its /deploy/fileDiff endpoint. This flaw allows authenticated users with low privileges to read arbitrary files on both the local host and remote servers managed by Goploy. The vulnerability is due to insufficient validation of the filePath parameter, enabling directory traversal attacks. Exploitation requires only a valid user account and configured projects and servers. The CVSS v3 score is 7.7, indicating high severity.
AI Analysis
Technical Summary
The vulnerability in Goploy (CVE-2026-53553) is a path traversal issue in the /deploy/fileDiff endpoint that allows users with member-level privileges to read arbitrary files on the local Goploy host and all remote servers managed by it. This occurs because the filePath parameter is not properly validated, permitting directory traversal attacks. The flaw requires authentication but no elevated privileges beyond a member role. The vulnerability affects versions up to and including 1.17.5. The CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact.
Potential Impact
An attacker with a valid user account and member privileges can read arbitrary files on both the local Goploy host and all remote servers managed by Goploy. This can lead to disclosure of sensitive information across multiple systems. There is no direct impact on integrity or availability reported. The vulnerability affects confidentiality and can compromise the security of deployment environments.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to the /deploy/fileDiff endpoint. Avoid granting unnecessary member-level access to untrusted users. Follow vendor updates for patches or official mitigations.
Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise (CVE-2026-53553)
Description
Goploy, an open-source automation deployment system, contains a high-severity path traversal vulnerability in its /deploy/fileDiff endpoint. This flaw allows authenticated users with low privileges to read arbitrary files on both the local host and remote servers managed by Goploy. The vulnerability is due to insufficient validation of the filePath parameter, enabling directory traversal attacks. Exploitation requires only a valid user account and configured projects and servers. The CVSS v3 score is 7.7, indicating high severity.
CVSS v3.1
Score 7.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Goploy (CVE-2026-53553) is a path traversal issue in the /deploy/fileDiff endpoint that allows users with member-level privileges to read arbitrary files on the local Goploy host and all remote servers managed by it. This occurs because the filePath parameter is not properly validated, permitting directory traversal attacks. The flaw requires authentication but no elevated privileges beyond a member role. The vulnerability affects versions up to and including 1.17.5. The CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact.
Potential Impact
An attacker with a valid user account and member privileges can read arbitrary files on both the local Goploy host and all remote servers managed by Goploy. This can lead to disclosure of sensitive information across multiple systems. There is no direct impact on integrity or availability reported. The vulnerability affects confidentiality and can compromise the security of deployment environments.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to the /deploy/fileDiff endpoint. Avoid granting unnecessary member-level access to untrusted users. Follow vendor updates for patches or official mitigations.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4g5x-hcwm-82jw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53553"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a4e4ee7c9d9e3dbe3289b3f
Added to database: 07/08/2026, 13:21:43 UTC
Last enriched: 09/07/2026, 11:07:31 UTC
Last updated: 09/15/2026, 00:15:06 UTC
Views: 119
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.