https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 04:24:32 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-53553 <p>Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.</p> <p>Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-53553 https://vulnerability.circl.lu/vuln/ghsa-4g5x-hcwm-82jw <p><strong>Affected:</strong> Go: github.com/zhenorzz/goploy</p> <p>&gt; [ Click here to jump to the Simplified Chinese version (点击跳转到简体中文版本)](#goploy-系统任意文件读取) # Goploy System Arbitrary File Read Vulnerability</p> <p>## Basic Information - **Vulnerability Name**: Goploy Endpoints Arbitrary File Read via Path Traversal - **Vulnerability Type**: Path Traversal (CWE-22) / Arbitrary File Read - **Affected Product**: Goploy - **Severity Level**: High (CVSS V3 7.7) - **Known Affected Versions**: &lt;=1.17.5</p> <p>## Vulnerability Description Goploy is an open-source automation deployment system. A severe path traversal vulnerability exists in its backend API endpoints, specifically `/deploy/fileDiff` (File Compare), when handling file paths provided by the client.</p> <p>The original logic of this endpoint is to read a local project file and compare it with a file on a remote target server. However, due to insufficient validation and sanitization of the `filePath` parameter, and the lack of security constraints on the final absolute file path, malicious paths containing `../` are directly executed within the system.</p> <p>This leads to a **dual arbitrary file read** issue: 1. **Local Host File Read**: `os.ReadFile` is tricked by the directory traversal payload to read any file via its absolute path on the Goploy local host (returned in the `srcText` field of the response body). 2. **Remote Controlled Server File Read**: Subsequently, the same payload is utilized via the SFTP protocol on the target server pointed to by the `serverID`. Influenced similarly by the directory t…</p> <p><strong>Affected:</strong> Go: github.com/zhenorzz/goploy</p> <p>&gt; [ Click here to jump to the Simplified Chinese version (点击跳转到简体中文版本)](#goploy-系统任意文件读取) # Goploy System Arbitrary File Read Vulnerability</p> <p>## Basic Information - **Vulnerability Name**: Goploy Endpoints Arbitrary File Read via Path Traversal - **Vulnerability Type**: Path Traversal (CWE-22) / Arbitrary File Read - **Affected Product**: Goploy - **Severity Level**: High (CVSS V3 7.7) - **Known Affected Versions**: &lt;=1.17.5</p> <p>## Vulnerability Description Goploy is an open-source automation deployment system. A severe path traversal vulnerability exists in its backend API endpoints, specifically `/deploy/fileDiff` (File Compare), when handling file paths provided by the client.</p> <p>The original logic of this endpoint is to read a local project file and compare it with a file on a remote target server. However, due to insufficient validation and sanitization of the `filePath` parameter, and the lack of security constraints on the final absolute file path, malicious paths containing `../` are directly executed within the system.</p> <p>This leads to a **dual arbitrary file read** issue: 1. **Local Host File Read**: `os.ReadFile` is tricked by the directory traversal payload to read any file via its absolute path on the Goploy local host (returned in the `srcText` field of the response body). 2. **Remote Controlled Server File Read**: Subsequently, the same payload is utilized via the SFTP protocol on the target server pointed to by the `serverID`. Influenced similarly by the directory t…</p> https://vulnerability.circl.lu/vuln/ghsa-4g5x-hcwm-82jw