CVE-2026-114665 in Goploy
Summary
by MITRE • 10/22/2026
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Goploy versions prior to 1.18.1 represents a critical path traversal issue rooted in improper handling of symbolic links within file comparison endpoints. Specifically, the /deploy/fileDiff and /deploy/fileCompare functions fail to validate whether the target files reside within the expected project directory boundaries before processing them. This flaw allows an authenticated user with repository write access to manipulate the input parameters or commit specific artifacts that cause the application to dereference a symbolic link pointing outside the designated sandboxed environment. By exploiting this mechanism, an attacker can bypass intended file system restrictions and read arbitrary files from the underlying host operating system.
The operational impact of this vulnerability is severe due to the potential for sensitive data exfiltration. Since Goploy typically manages deployment configurations and infrastructure secrets, the ability to traverse outside the project directory enables attackers to access critical configuration files such as database connection strings containing plaintext credentials or SSH private keys used for remote server authentication. The compromise of these assets can lead to unauthorized access to backend databases, lateral movement across internal networks, and full control over deployed services. This scenario is particularly dangerous in continuous integration and deployment pipelines where automated processes often rely on stored secrets without additional runtime verification.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws allowing access to files outside the restricted directory. Furthermore, it maps to MITRE ATT&CK technique T1083: File and Directory Discovery, as the attacker utilizes the application's functionality to enumerate and read sensitive system resources. The attack vector leverages authenticated privileges, specifically requiring write access to commit a malicious symlink, which places this within the context of insider threats or compromised developer credentials rather than unauthenticated remote exploitation.
Mitigation strategies should prioritize immediate upgrading to Goploy version 1.18.1 or later where these path validation checks have been implemented. In addition to patching, organizations must enforce strict least-privilege principles for repository access, ensuring that write permissions are granted only to trusted individuals and automated service accounts with minimal necessary scope. Security teams should also implement file integrity monitoring on deployment servers to detect unauthorized symlink creations or unexpected file reads. Regular audits of CI/CD pipeline configurations and the use of secret scanning tools can further reduce the risk associated with stored credentials being exposed through such vulnerabilities.