
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-53553 is a path traversal vulnerability in Goploy, an open-source automation deployment system, that allows authenticated low-privileged users to read arbitrary files on both the Goploy host and all remotely managed servers. The vulnerability affects all versions up to and including 1.17.5, with no patched version currently available. It was first published by the repository maintainer on June 1, 2026, and added to the GitHub Advisory Database on July 7, 2026. The vulnerability carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, Goploy Advisory).
The root cause is improper input validation (CWE-22: Path Traversal) combined with exposure of sensitive information (CWE-200) in the /deploy/fileDiff API endpoint. The endpoint is designed to read a local project file and compare it with a file on a remote server via SFTP, but it fails to sanitize or restrict the filePath parameter supplied by the client. An attacker can inject ../ sequences into the filePath JSON field, causing Go's os.ReadFile to resolve an arbitrary absolute path on the local host (returned in srcText) and simultaneously triggering an SFTP read of an arbitrary file on the remote managed server (returned in distText). The only access control bypass required is specifying the correct G-N-ID namespace header, which can be obtained by querying the /namespace/getOption endpoint with a valid low-privilege session token. A full public PoC Python script (poc.py) is included in the advisory (GitHub Advisory, Goploy Advisory).
Successful exploitation enables a low-privileged authenticated attacker to read any file accessible to the Goploy process on the local host — including /etc/passwd, /etc/shadow, application configuration files, and database credentials — as well as any file on every remote server managed by Goploy via SFTP. By reading SSH private keys (e.g., ~/.ssh/id_rsa) from the host or managed servers, an attacker can achieve passwordless SSH access to those systems, effectively escalating the impact to the equivalent of remote code execution across the entire managed infrastructure. By enumerating serverID values, Goploy can be weaponized as a pivot point for large-scale credential and configuration theft across all bound deployment targets (GitHub Advisory, Goploy Advisory).
member-role account on the target Goploy instance (default installations grant this role "File Compare" permission automatically).goploy_token cookie/JWT./namespace/getOption with the session cookie to retrieve the available namespaceId value (e.g., 1)./server/getOption and /deploy/getList to obtain valid serverId and projectId values, or default to 1 for both./deploy/fileDiff with the G-N-ID header set to the namespace ID and a filePath value containing repeated ../ sequences (e.g., ../../../../../../../../../../etc/passwd):curl -s -X POST -b "goploy_token=<TOKEN>" \
-H "Content-Type: application/json" \
-H "G-N-ID: 1" \
-d '{"projectId":1,"serverId":1,"filePath":"../../../../../../../../../../etc/passwd"}' \
"http://<TARGET>/deploy/fileDiff"srcText contains the file from the Goploy host, and distText contains the file from the remote managed server.~/.ssh/id_rsa) from the host or managed servers to gain passwordless SSH access; enumerate additional serverID values to pivot across all managed infrastructure (GitHub Advisory, Goploy Advisory)./deploy/fileDiff containing ../ sequences in the JSON body filePath field; repeated requests to the same endpoint with incrementing serverId values (enumeration pattern); outbound SFTP connections from the Goploy host to managed servers triggered outside of normal deployment windows./deploy/fileDiff with encoded or raw path traversal strings (e.g., ../../../../../../../../../../etc/passwd); API calls to /namespace/getOption, /server/getOption, and /deploy/getList in rapid succession from the same session, indicating automated enumeration./var/log/auth.log or /var/log/secure on managed servers.As of the advisory publication date, no patched version of Goploy is available — all versions up to and including 1.17.5 are affected. Administrators should apply the following mitigations immediately:
FileCompare permission from the default member role in Goploy's role management settings to prevent low-privileged users from accessing the vulnerable endpoint./deploy/fileDiff containing ../ in the request body.The vulnerability was discovered and reported by researcher "What-canIsay" and published by the Goploy maintainer (zhenorzz) as a GitHub Security Advisory on June 1, 2026. The advisory was reviewed and added to the GitHub Advisory Database on July 7, 2026. No significant broader media coverage, vendor statements beyond the advisory itself, or notable social media discussion has been identified at this time (Goploy Advisory).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."