CVE-2026-53553: Goploy Path Traversal Vulnerability

CVE-2026-53553 Overview

Goploy is an open-source automation deployment system. CVE-2026-53553 is a path traversal vulnerability [CWE-22] affecting Goploy versions prior to 1.18.0. The flaw resides in backend API endpoints that handle client-supplied file paths, most notably the /deploy/fileDiff (File Compare) endpoint. An authenticated attacker can supply crafted relative paths containing traversal sequences to access files outside the intended project directory. The issue is patched in version 1.18.0.

Critical Impact
Authenticated remote attackers can read arbitrary files on the Goploy server, exposing source code, credentials, deployment keys, and configuration data across projects.

Affected Products

Goploy versions prior to 1.18.0
/deploy/fileDiff File Compare endpoint
Additional project file endpoints in cmd/server/api/project/handler.go

Discovery Timeline

2026-08-31 - CVE-2026-53553 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-53553

Vulnerability Analysis

The vulnerability affects Goploy's backend Go handlers that accept file path parameters from authenticated API clients. The /deploy/fileDiff endpoint and related project file endpoints join user-controlled path values with the configured project directory using path.Join, then read the resulting location from disk.

Because path.Join normalizes traversal sequences such as ../ without enforcing that the final path stays within the project root, an attacker can escape the intended directory. The server then returns file contents or diff output for paths anywhere the Goploy process has read access.

The weakness is classified as Improper Limitation of a Pathname to a Restricted Directory [CWE-22]. Exploitation requires low-privilege authenticated access, and the scope change reflects that a compromise of the deployment service can expose data owned by other projects and system users.

Root Cause

The root cause is missing validation of relative path input before it reaches file system operations. The handlers trusted the FilePath and Path fields from request bodies. No canonicalization or containment check confirmed that the resolved path remained within config.GetProjectPath(reqData.ID).

Attack Vector

An authenticated user submits a request to a vulnerable endpoint with a FilePath or Path value containing traversal sequences such as ../../../../etc/passwd. The server joins the input with the project base path, resolves the traversal, and returns file contents through the diff or listing response.

The patch in commit d51aa15 introduces pkg.ValidateRelativePath to reject inputs that escape the project directory:

		return response.JSON{Code: response.Error, Message: err.Error()}
	}

+	if err := pkg.ValidateRelativePath(reqData.FilePath); err != nil {
+		return response.JSON{Code: response.Error, Message: err.Error()}
+	}
+
	project, err := model.Project{ID: reqData.ProjectID}.GetData()
	if err != nil {
		return response.JSON{Code: response.Error, Message: err.Error()}

Source: GitHub Commit d51aa15 - deploy/handler.go

The same validation is applied to the project file listing handler:

		return response.JSON{Code: response.Error, Message: err.Error()}
	}

+	if err := pkg.ValidateRelativePath(reqData.Path); err != nil {
+		return response.JSON{Code: response.Error, Message: err.Error()}
+	}
+
	files, err := os.ReadDir(path.Join(config.GetProjectPath(reqData.ID), reqData.Path))
	if err != nil {
		return response.JSON{Code: response.Error, Message: err.Error()}

Source: GitHub Commit d51aa15 - project/handler.go

Detection Methods for CVE-2026-53553

Indicators of Compromise

HTTP requests to /deploy/fileDiff or project file endpoints containing ../, ..\, or URL-encoded traversal sequences (%2e%2e%2f) in the FilePath or Path parameter.
Goploy access logs showing successful reads of files outside the configured project directory (for example /etc/passwd, ~/.ssh/id_rsa, or Goploy configuration files).
Anomalous file access by the Goploy process user targeting SSH keys, environment files, or /proc entries.

Detection Strategies

Inspect Goploy application logs for path parameters containing traversal patterns and correlate with authenticated session identifiers.
Deploy a web application firewall rule that inspects JSON request bodies to Goploy API endpoints for ../ sequences.
Monitor the Goploy service account for file reads outside its expected project directories using host-based file integrity or eBPF telemetry.

Monitoring Recommendations

Alert on repeated 200 responses from /deploy/fileDiff where the response body includes content from system paths.
Track authentication events for low-privilege Goploy accounts that immediately begin issuing file diff or file listing requests.
Baseline normal FilePath values per project and flag deviations that reference parent directories or absolute paths.

How to Mitigate CVE-2026-53553

Immediate Actions Required

Upgrade Goploy to version 1.18.0 or later, which introduces pkg.ValidateRelativePath on all affected endpoints.
Rotate any secrets, SSH keys, and deployment credentials that were accessible to the Goploy service, assuming disclosure until logs prove otherwise.
Restrict network access to the Goploy management interface so that only trusted operators can reach the API.
Audit Goploy user accounts and revoke unused low-privilege accounts that could be leveraged for exploitation.

Patch Information

The vulnerability is fixed in Goploy 1.18.0. The fix is implemented in commit d51aa15ebc0a474d9d71d6c453a0fe798dd5e007, which adds pkg.ValidateRelativePath calls before file system operations in cmd/server/api/deploy/handler.go and cmd/server/api/project/handler.go. See the GitHub Security Advisory GHSA-4g5x-hcwm-82jw and the Goploy v1.18.0 release notes for full details.

Workarounds

Place Goploy behind a reverse proxy that filters request bodies for traversal sequences until the upgrade is applied.
Run the Goploy binary under a dedicated, unprivileged system account with read access limited to project directories.
Apply mandatory access controls (AppArmor, SELinux) or filesystem sandboxing to prevent the process from reading sensitive files outside project paths.

bash

# Verify Goploy version and upgrade
goploy --version
# Upgrade to patched release
wget https://github.com/zhenorzz/goploy/releases/tag/v1.18.0
# Restart service after replacing the binary
systemctl restart goploy