Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck

CVE-2026-114665Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare

Medium 6.5

In plain English

A medium-severity security flaw in goploy from zhenorzz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 70.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/zhenorzz/goploy	1.18.0	GHSA-4g5x-hcwm-82jw
Go	github.com/zhenorzz/goploy	no fix listed	GO-2026-5938

Affected products (as reported)

Vendor	Product	Versions
zhenorzz	goploy	1.18.0 – before 1.18.1

Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Patch Commit patch
goploy v1.18.1 Release Notes release-notes
https://github.com/zhenorzz/goploy/blob/v1.18.0/cmd/server/api/deploy/handler.go#L404-L418 technical-description
GitHub Security Advisory (GHSA-4g5x-hcwm-82jw) related, vendor-advisory
https://github.com/zhenorzz/goploy product
VulnCheck Advisory: Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare third-party-advisory