CVE-2026-53553High· 7.7▾ TwilightGoploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/zhenorzz/goploy <= 1.17.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114665High· 7.7Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise
CVE-2026-53552Critical· 9.6Goploy is an open-source automation deployment system
CVE-2021-3426Medium· 5.7There's a flaw in Python 3's pydoc
CVE-2025-11079Medium· 5.3A security flaw has been discovered in Campcodes Farm Management System 1.0
CVE-2021-41277Critical· 10.0Metabase is an open source data analytics platform
CVE-2022-31746Medium· 6.5Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header