Description
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zhenorzz | goploy | 1.18.0 – < 1.18.1 | 1.18.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/zhenorzz/goploy | < 1.18.0 | 1.18.0 | GHSA-4g5x-hcwm-82jw |
| Go | github.com/zhenorzz/goploy | all versions | — | GO-2026-5938 |
References
- Patch Commit patch
- goploy v1.18.1 Release Notes release-notes
- https://github.com/zhenorzz/goploy/blob/v1.18.0/cmd/server/api/deploy/handler.go#L404-L418 technical-description
- GitHub Security Advisory (GHSA-4g5x-hcwm-82jw) related vendor-advisory
- https://github.com/zhenorzz/goploy product
- VulnCheck Advisory: Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare third-party-advisory