Threats tagged 'ghsa-4g5x-hcwm-82jw'

Goploy, an open-source automation deployment system, contains a high-severity path traversal vulnerability in its /deploy/fileDiff endpoint. This flaw allows authenticated users with low privileges to read arbitrary files on both the local host and remote servers managed by Goploy. The vulnerability is due to insufficient validation of the filePath parameter, enabling directory traversal attacks. Exploitation requires only a valid user account and configured projects and servers. The CVSS v3 score is 7.7, indicating high severity.