ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-114665

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy

Published Jul 7, 2026 · catalog updated Oct 23, 2026 · Goploy: Arbitrary File Read

Check if you run it

No confirmed exploitation is on record for CVE-2026-114665. EPSS is 0.35%. Act only if a listed version of Goploy: Arbitrary File Read is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Goploy: Arbitrary File Read).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.35%
Remediation
Advisory link
Affected products
Go github.com/zhenorzz/goploy

> [ Click here to jump to the Simplified Chinese version (点击跳转到简体中文版本)](#goploy-系统任意文件读取) # Goploy System Arbitrary File Read Vulnerability ## Basic Information - **Vulnerability Name**: Goploy Endpoints Arbitrary File Read via Path Traversal - **Vulnerability Type**: Path Traversal (CWE-22) / Arbitrary File Read - **Affected Product**: Goploy - **Severity Level**: High (CVSS V3 7.7) - **Known Affected Versions**: Configured two managed remote servers: Created a normal user and assigned the role (which includes File Compare permission): 2. **Obtain Normal User Privileges** Log in to the system using the registered account to obtain valid authentication credentials (Cookie/Token). 3. **Execute poc.py (See below)** * **Parameter Explanation:** : Target URL : Target Cookie/Token to use : File to read : ID of the managed server to read from * **Reading from the first managed server (Server ID: 1):** * **Reading from the second managed server (Server ID: 2):** 4. **Reproduction Result** The server successfully returns the full contents of the file from both the Goploy host and the designated remote servers. ## Impact Through this vulnerability, an attacker can bypass authorization to read any sensitive files on the host machine as well as all managed target servers. For example: - Read or on the local or remote target servers to obtain host system user information. - Read users' SSH private keys (e.g., ) across different systems, enabling passwordless SSH access to the host or cross-network connections to other servers to steal administrative control, achieving the equivalent of Remote Code Execution (RCE). - By enumerating the , an attacker can use Goploy as a jump server (bastion host) to conduct large-scale information theft against all bound deployment target systems. - Obtain various critical configuration files, database credentials, etc., of the affected systems. ## Remediation Suggestions 1. **Input Parameter Filtering**: Strictly filter special characters such a

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/zhenorzz/goploy0 → 1.17.5

How to fix CVE-2026-114665

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-114665. EPSS is 0.35%. Act only if a listed version of Goploy: Arbitrary File Read is installed.

Which versions are affected?

Compare what you have installed with 0 → 1.17.5. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-200: Exposure of Sensitive Information; CWE-22: Path Traversal; CWE-59: Link Following. EPSS 0.35%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 22, 2026 · NIST NVD

    Detected

    Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.

  2. Oct 23, 2026 · GitHub Advisory Database

    Fix available

    github.com/zhenorzz/goploy fixed in 1.17.5

  3. Oct 23, 2026 · GitHub Advisory Database

    Updated

    Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy

Sources

  • CVE.orgVulnerability recordCVE-2026-114665

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-114665

    30-day exploitation probability 0.35%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-4g5x-hcwm-82jw

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • Go Vulnerability DatabasePackage advisoryGHSA-4g5x-hcwm-82jw

    Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

    osv.dev
  • Go Vulnerability DatabasePackage advisoryGO-2026-5938

    Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy

    osv.dev
  • NIST NVDVulnerability recordCVE-2026-114665

    Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project direct

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-4g5x-hcwm-82jw

    Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

    osv.dev
  • OpenSSF OSV / OSV ScannerPackage advisoryGO-2026-5938

    Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy

    osv.dev

References

Freshness

Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.