CVE-2026-53553: 
vulnerability analysis and mitigation

CVE-2026-53553 is a path traversal vulnerability in Goploy, an open-source automation deployment system, that allows authenticated low-privileged users to read arbitrary files on both the Goploy host server and all remotely managed target servers. The vulnerability affects all versions up to and including 1.17.5, with no patched version currently available. It was first published by the maintainer on June 1, 2026, and added to the GitHub Advisory Database on July 7, 2026. The vulnerability carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, Goploy Advisory).

The root cause is insufficient validation and sanitization of the filePath parameter in the /deploy/fileDiff (File Compare) API endpoint, classified as CWE-22 (Path Traversal) and CWE-200 (Exposure of Sensitive Information). The endpoint is designed to read a local project file and compare it with a file on a remote server via SFTP, but because the filePath value is passed directly to os.ReadFile without path normalization or boundary checks, an attacker can inject ../ sequences to escape the intended directory. This results in a dual arbitrary file read: the srcText field in the response contains the traversed file from the local Goploy host, while distText contains the traversed file from the remote server accessed via SFTP. The attack requires only a valid low-privileged session token and knowledge of the G-N-ID namespace header, both of which are trivially obtainable (GitHub Advisory, Goploy Advisory).

Successful exploitation allows an attacker to read any file accessible to the Goploy process on the local host (e.g., /etc/passwd, /etc/shadow, application configuration files, database credentials) and simultaneously read arbitrary files on every remote server managed by Goploy via SFTP. The most severe consequence is the theft of SSH private keys (e.g., ~/.ssh/id_rsa), which can enable passwordless SSH access to the Goploy host and all managed servers — effectively achieving remote code execution equivalence. By enumerating serverID values, an attacker can use Goploy as a pivot point to conduct large-scale credential and configuration theft across an entire managed infrastructure (Goploy Advisory).

1. Obtain low-privileged credentials: Register or obtain credentials for any member-role account on the target Goploy instance. Retrieve the valid goploy_token cookie after login.
2. Discover Namespace ID: Send a GET request to /namespace/getOption with the session cookie to retrieve the available namespace ID (e.g., G-N-ID: 1).
3. Enumerate Server IDs: Send a GET request to /server/getOption with the session cookie and G-N-ID header to retrieve available managed server IDs.
4. Enumerate Project IDs: Send a GET request to /deploy/getList to retrieve available project IDs.
5. Craft path traversal payload: Construct a POST request to /deploy/fileDiff with a filePath value containing repeated ../ sequences to escape the project directory, e.g., ../../../../../../../../../../etc/passwd.
6. Send exploit request: Execute the request:

curl -s -X POST -b "goploy_token=<TOKEN>" \
  -H "Content-Type: application/json" \
  -H "G-N-ID: 1" \
  -d '{"projectId":1,"serverId":1,"filePath":"../../../../../../../../../../etc/passwd"}' \
  "http://<TARGET>/deploy/fileDiff"

7. Extract file contents: Parse the JSON response — data.srcText contains the file from the Goploy host, and data.distText contains the file from the remote managed server.
8. Escalate via SSH key theft: Repeat with filePath targeting ~/.ssh/id_rsa or /root/.ssh/id_rsa across multiple serverID values to harvest SSH private keys for lateral movement (GitHub Advisory, Goploy Advisory).

• Network: Repeated POST requests to /deploy/fileDiff from a single authenticated session, especially with unusual frequency or targeting multiple serverID values; GET requests to /namespace/getOption, /server/getOption, and /deploy/getList in rapid succession from the same session.
• Logs: Goploy access logs showing POST requests to /deploy/fileDiff with filePath values containing ../ sequences or absolute paths outside the project workspace; HTTP 200 responses to these requests indicating successful file reads.
• File System: No direct file system artifacts on the attacker side; however, sensitive files such as /etc/shadow or ~/.ssh/id_rsa being accessed by the Goploy process may appear in OS-level audit logs (e.g., Linux auditd records for file open events by the Goploy process).
• Process: Unexpected SFTP connections initiated by the Goploy service to managed remote servers outside of normal deployment windows, particularly reading files outside project directories.

As of the advisory publication date, no patched version of Goploy is available — all versions up to and including 1.17.5 are affected. Administrators should apply the following mitigations immediately:

• Input filtering: Reject or sanitize filePath parameters containing ../, ..\, or %00 characters at the API layer.
• Path boundary enforcement: Use Go's filepath.Clean to normalize paths and validate that the resolved absolute path falls within an allowed project workspace directory before passing it to os.ReadFile or SFTP operations.
• Least privilege: Run the Goploy service as a low-privileged OS user to limit the scope of files accessible via traversal.
• Permission review: Audit and restrict the "File Compare" permission from the default member role if not operationally required.
• API audit: Review all other Goploy API endpoints for similar path traversal patterns, as the advisory notes multiple additional vulnerable endpoints (GitHub Advisory, Goploy Advisory).