{"id":"CVE-2026-114665","kind":"vulnerability","aliases":["CVE-2026-114665"],"related":[],"title":"Goploy: symlink following lets members read arbitrary server files","description":"Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.","summary":"Goploy 1.18.0 before 1.18.1 follows symlinks in the /deploy/fileDiff and /deploy/fileCompare endpoints. An authenticated member with repository write access can commit a symlink pointing outside the project and read files such as database configuration and deployment SSH private keys.","severity":"high","cvss":7.1,"epss":0.00353,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["deployment","goploy","package","self-hosted","ssh"],"not_affected_if":["no-repo-write-access-for-untrusted-users","version-1.18.1-or-later"],"how_to_check":"- Check the installed Goploy version; it is affected if it is `1.18.0` or later than that but before `1.18.1`.\n- Review which users have repository write access in Goploy, since they can plant the symlink.","fix":"- Upgrade Goploy to `1.18.1` or later.\n- Rotate database credentials and deployment SSH keys if untrusted members had repository write access before the upgrade.","status":"open","published_at":"2026-10-22T11:17:43+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:31:36+00:00","updated_at":"2026-10-25T03:31:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:31:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Goploy to `1.18.1` or later.\n- Rotate database credentials and deployment SSH keys if untrusted members had repository write access before the upgrade.","reach":"internet","title":"Goploy: symlink following lets members read arbitrary server files","impact":"high","summary":"Goploy 1.18.0 before 1.18.1 follows symlinks in the /deploy/fileDiff and /deploy/fileCompare endpoints. An authenticated member with repository write access can commit a symlink pointing outside the project and read files such as database configuration and deployment SSH private keys.","category":"package","nicknames":[],"who_cares":["goploy","self-hosted","deployment","ssh"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads database config and deployment SSH private keys from the server.","analyst_note":"","how_to_check":"- Check the installed Goploy version; it is affected if it is `1.18.0` or later than that but before `1.18.1`.\n- Review which users have repository write access in Goploy, since they can plant the symlink.","needs_analyst":false,"not_affected_if":["version-1.18.1-or-later","no-repo-write-access-for-untrusted-users"],"who_is_affected":"Teams running Goploy 1.18.0 before 1.18.1 where more than a few people have repository write access. The attacker needs an authenticated account with write access to a deployed repository, so instances where only trusted maintainers can commit are lower risk. unknown whether any hosted or managed Goploy offering is involved.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000625,"input_tokens":3387,"output_tokens":573,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114665':12A,15A '-2026':11A,14A '/deploy/filecompare':33B,75C '/deploy/filediff':31B,73C '1.18.0':24B,63C '1.18.1':26B,65C 'access':41B,89C 'allow':78C 'arbitrari':7A,83C 'attack':85C 'authent':36B,79C 'commit':43B,91C 'configur':56B,102C 'contain':66C 'cve':10A,13A 'databas':55B,101C 'deploy':16B,58B,104C 'directori':98C 'endpoint':34B,76C 'file':9A,52B,84C 'follow':3A,27B,69C 'goploy':1A,17B,23B,62C 'host':21B 'key':61B,107C 'let':4A 'link':68C 'member':5A,37B,80C 'outsid':47B,95C 'packag':18B 'point':46B,94C 'privat':60B,106C 'project':49B,97C 'read':6A,51B,82C,100C 'repositori':39B,87C 'self':20B 'self-host':19B 'server':8A 'ssh':22B,59B,105C 'symlink':2A,28B,45B,93C 'vulner':70C 'write':40B,88C","nicknames":[],"mitigations":[],"who_affected":"Teams running Goploy 1.18.0 before 1.18.1 where more than a few people have repository write access. The attacker needs an authenticated account with write access to a deployed repository, so instances where only trusted maintainers can commit are lower risk. unknown whether any hosted or managed Goploy offering is involved.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114665","severity":null,"published_at":"2026-10-22T11:17:43+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114665","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114665","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}