Live › vulnerability › CVE-2026-114665
Go to dashboardGoploy 1.18.0 before 1.18.1 follows symlinks in the /deploy/fileDiff and /deploy/fileCompare endpoints. An authenticated member with repository write access can commit a symlink pointing outside the project and read files such as database configuration and deployment SSH private keys.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Goploy 1.18.0 before 1.18.1 where more than a few people have repository write access. The attacker needs an authenticated account with write access to a deployed repository, so instances where only trusted maintainers can commit are lower risk. unknown whether any hosted or managed Goploy offering is involved.
No product ranges from the sources yet.
1.18.0 or later than that but before 1.18.1.1.18.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.
This page as .md · .json · in your agent: get_signal("CVE-2026-114665")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.