{"id":"CVE-2026-114665","summary":"Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare","details":"Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.","aliases":["CVE-2026-53553","GHSA-4g5x-hcwm-82jw","GO-2026-5938"],"modified":"2026-10-23T02:55:59.233579620Z","published":"2026-10-22T10:57:39.553Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-59"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114665.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114665.json"},{"type":"PACKAGE","url":"https://github.com/zhenorzz/goploy"},{"type":"ARTICLE","url":"https://github.com/zhenorzz/goploy/blob/v1.18.0/cmd/server/api/deploy/handler.go#L404-L418"},{"type":"FIX","url":"https://github.com/zhenorzz/goploy/commit/97a49839cc27470f4e804d985fbd2bddac085a3a"},{"type":"ADVISORY","url":"https://github.com/zhenorzz/goploy/releases/tag/v1.18.1"},{"type":"ADVISORY","url":"https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114665"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/goploy-1.18.0-before-1.18.1-symlink-following-arbitrary-file-read-via-deploy-filediff-and-deploy-filecompare"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zhenorzz/goploy","events":[{"introduced":"4c682981730fb74d599a5cd84a094c5ba6fd4b89"},{"fixed":"70389b674bb8d0a30d1a1b8f77c6614526c73af7"},{"fixed":"97a49839cc27470f4e804d985fbd2bddac085a3a"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"1.18.0"},{"fixed":"1.18.1"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"97a49839cc27470f4e804d985fbd2bddac085a3a"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v1.18.1","range":[{"fixed":"70389b674bb8d0a30d1a1b8f77c6614526c73af7"}]}]}}],"versions":["v1.18.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114665.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}