Description

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-31T19:16:51.030Z",
  "pubdate": "2026-08-31T19:16:51.030Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the Goploy automation deployment system, specifically within the backend API endpoint /deploy/fileDiff.\nThis vulnerability allows an unauthenticated or authenticated attacker (depending on deployment configuration) to manipulate file paths, potentially leading to unauthorized access to sensitive files residing outside the intended application directory.\nThe root cause lies in the improper sanitization of user-supplied input used to reference file paths during file comparison operations.\nSuccessful exploitation grants an attacker the ability to read arbitrary files from the underlying server's filesystem, compromising the integrity and confidentiality of the deployment environment.\nThis vulnerability poses a significant risk to organizational infrastructure, as deployment systems often have elevated privileges to interact with sensitive source code, configuration files, and secrets.\nThe issue has been effectively remediated in Goploy version 1.18.0, and immediate migration to this version is strongly advised to mitigate potential unauthorized data exfiltration.",
  "technicalDetails": "The vulnerability resides within the Goploy backend API logic associated with the /deploy/fileDiff endpoint. The flaw is categorized as a path traversal (or directory traversal) vulnerability, which occurs when the application uses client-controlled input to construct a file path without sufficient validation or normalization.\nDuring the execution of the file comparison function, the application fails to restrict file access to the designated project or deployment workspace directories. An attacker can manipulate the path parameter by injecting directory traversal sequences—most commonly '../' (dot-dot-slash)—to navigate outside the intended filesystem boundaries.\nAttack flow typically follows this sequence: An attacker crafts a malicious HTTP request targeting the /deploy/fileDiff endpoint. Within the request parameters responsible for defining the target file path, the attacker inserts traversal sequences. When the backend processes this request, the system API, failing to sanitize or resolve the path correctly, concatenates the malicious input with the base directory path. Consequently, the operating system resolves the path to an arbitrary file location chosen by the attacker.\nThe vulnerable component is the backend file-handling logic that interfaces with the server's filesystem. Because this component is used for file difference analysis, it possesses the requisite read permissions to interact with files that the Goploy service account can access.\nThe exploitation does not necessarily require complex payload injection; simple string manipulation of file paths is sufficient to traverse the directory structure. Once the traversal is successful, the contents of the targeted file are read by the application and potentially returned in the API response or exposed via the diff output interface.\nThe scope of impact is highly dependent on the privileges assigned to the user or service account running the Goploy process. If the service runs with elevated permissions (e.g., root or a system-wide user), the attacker could potentially read sensitive system configuration files, private keys, environment variables, or other deployment-related secrets stored on the server.\nThis vulnerability affects all Goploy versions prior to 1.18.0. Mitigation involves updating the affected software to version 1.18.0, which includes the necessary path validation logic to ensure that all file operations are constrained to an allowed directory (chroot or jail-like logic)."
}