CVE-2026-53553: 
vulnerability analysis and mitigation

CVE-2026-53553 is a path traversal vulnerability in Goploy, an open-source automation deployment system, that allows authenticated low-privileged users to read arbitrary files on both the Goploy host and all remotely managed servers. The vulnerability affects all versions up to and including 1.17.5, with no patched version currently available. It was first published by the repository maintainer on June 1, 2026, and added to the GitHub Advisory Database on July 7, 2026. The vulnerability carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, Goploy Advisory).

The root cause is improper input validation (CWE-22: Path Traversal) combined with exposure of sensitive information (CWE-200) in the /deploy/fileDiff API endpoint. The endpoint is designed to read a local project file and compare it with a file on a remote server via SFTP, but it fails to sanitize or restrict the filePath parameter supplied by the client. An attacker can inject ../ sequences into the filePath JSON field, causing Go's os.ReadFile to resolve an arbitrary absolute path on the local host (returned in srcText) and simultaneously triggering an SFTP read of an arbitrary file on the remote managed server (returned in distText). The only access control bypass required is specifying the correct G-N-ID namespace header, which can be obtained by querying the /namespace/getOption endpoint with a valid low-privilege session token. A full public PoC Python script (poc.py) is included in the advisory (GitHub Advisory, Goploy Advisory).

Successful exploitation enables a low-privileged authenticated attacker to read any file accessible to the Goploy process on the local host — including /etc/passwd, /etc/shadow, application configuration files, and database credentials — as well as any file on every remote server managed by Goploy via SFTP. By reading SSH private keys (e.g., ~/.ssh/id_rsa) from the host or managed servers, an attacker can achieve passwordless SSH access to those systems, effectively escalating the impact to the equivalent of remote code execution across the entire managed infrastructure. By enumerating serverID values, Goploy can be weaponized as a pivot point for large-scale credential and configuration theft across all bound deployment targets (GitHub Advisory, Goploy Advisory).

1. Obtain low-privileged credentials: Register or obtain credentials for any member-role account on the target Goploy instance (default installations grant this role "File Compare" permission automatically).
2. Authenticate and retrieve session token: Log in to the Goploy web interface or API to obtain a valid goploy_token cookie/JWT.
3. Enumerate Namespace ID: Send a GET request to /namespace/getOption with the session cookie to retrieve the available namespaceId value (e.g., 1).
4. Enumerate Server and Project IDs (optional): Query /server/getOption and /deploy/getList to obtain valid serverId and projectId values, or default to 1 for both.
5. Construct traversal payload: Build a POST request to /deploy/fileDiff with the G-N-ID header set to the namespace ID and a filePath value containing repeated ../ sequences (e.g., ../../../../../../../../../../etc/passwd):

curl -s -X POST -b "goploy_token=<TOKEN>" \
  -H "Content-Type: application/json" \
  -H "G-N-ID: 1" \
  -d '{"projectId":1,"serverId":1,"filePath":"../../../../../../../../../../etc/passwd"}' \
  "http://<TARGET>/deploy/fileDiff"

6. Extract file contents: Parse the JSON response — srcText contains the file from the Goploy host, and distText contains the file from the remote managed server.
7. Escalate access: Read SSH private keys (e.g., ~/.ssh/id_rsa) from the host or managed servers to gain passwordless SSH access; enumerate additional serverID values to pivot across all managed infrastructure (GitHub Advisory, Goploy Advisory).

• Network: Unusual POST requests to /deploy/fileDiff containing ../ sequences in the JSON body filePath field; repeated requests to the same endpoint with incrementing serverId values (enumeration pattern); outbound SFTP connections from the Goploy host to managed servers triggered outside of normal deployment windows.
• Logs: Goploy access logs showing POST requests to /deploy/fileDiff with encoded or raw path traversal strings (e.g., ../../../../../../../../../../etc/passwd); API calls to /namespace/getOption, /server/getOption, and /deploy/getList in rapid succession from the same session, indicating automated enumeration.
• File System: No direct file system artifacts on the Goploy host from read-only exploitation; however, subsequent SSH logins using stolen private keys from unexpected source IPs may appear in /var/log/auth.log or /var/log/secure on managed servers.
• Process: Unexpected SFTP sessions initiated by the Goploy process to managed servers outside of scheduled deployment activity (GitHub Advisory).

As of the advisory publication date, no patched version of Goploy is available — all versions up to and including 1.17.5 are affected. Administrators should apply the following mitigations immediately:

• Restrict the "File Compare" permission: Remove the FileCompare permission from the default member role in Goploy's role management settings to prevent low-privileged users from accessing the vulnerable endpoint.
• Network-level controls: Restrict access to the Goploy web interface to trusted IP ranges only; do not expose Goploy directly to the internet.
• Least privilege for the Goploy process: Run the Goploy service as a low-privileged OS user to limit the scope of files readable via exploitation.
• Monitor for exploitation: Alert on POST requests to /deploy/fileDiff containing ../ in the request body.
• Audit other API endpoints: The advisory notes that multiple other Goploy API endpoints may be affected by similar path traversal issues; a comprehensive audit is recommended (GitHub Advisory, Goploy Advisory).

The vulnerability was discovered and reported by researcher "What-canIsay" and published by the Goploy maintainer (zhenorzz) as a GitHub Security Advisory on June 1, 2026. The advisory was reviewed and added to the GitHub Advisory Database on July 7, 2026. No significant broader media coverage, vendor statements beyond the advisory itself, or notable social media discussion has been identified at this time (Goploy Advisory).