CVE-2026-53553

Goploy, an open-source automation deployment system, contains a path traversal flaw (CWE-22) in its backend API endpoint /deploy/fileDiff (File Compare), where client-supplied file paths are not properly validated. An attacker with low-privileged authenticated access to the API can manipulate the file path parameter to escape the intended directory and read arbitrary files on the server (CWE-200), resulting in high-confidence-impact information disclosure such as exposure of configuration files, credentials, or application data, with no integrity or availability impact. All Goploy deployments running versions prior to 1.18.0 are affected, and the issue is fixed in version 1.18.0. There are currently no known public proofs of concept, no reports of in-the-wild exploitation, and the vulnerability is not listed in CISA KEV, with an EPSS 30-day exploitation probability of about 0.3%.

What to do: Upgrade Goploy to version 1.18.0 or later, which patches the /deploy/fileDiff path traversal. Until upgraded, restrict access to the Goploy API to trusted, low-privilege users and review the fileDiff endpoint for unexpected file-path parameters; if the instance is internet-exposed, audit logs for anomalous file-diff requests.