{"id":"EUVD-2026-108121","enisaUuid":"901342d9-eb1f-39a4-b6c8-e94ec0853188","description":"Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.","datePublished":"Oct 22, 2026, 10:57:39 AM","dateUpdated":"Oct 29, 2026, 2:07:01 AM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/zhenorzz/goploy/commit/97a49839cc27470f4e804d985fbd2bddac085a3a\nhttps://github.com/zhenorzz/goploy/releases/tag/v1.18.1\nhttps://github.com/zhenorzz/goploy/blob/v1.18.0/cmd/server/api/deploy/handler.go#L404-L418\nhttps://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw\nhttps://github.com/zhenorzz/goploy\nhttps://www.vulncheck.com/advisories/goploy-1.18.0-before-1.18.1-symlink-following-arbitrary-file-read-via-deploy-filediff-and-deploy-filecompare\n","aliases":"CVE-2026-114665\nGHSA-q5pp-jrgg-4fpm\n","assigner":"VulnCheck","epss":0.35,"enisaIdProduct":[{"id":"d0a1b6d2-d6b1-3370-8d35-ef211a63db39","product":{"name":"goploy","vendor":{"name":"zhenorzz"}},"product_version":"1.18.0 \u003c1.18.1"}],"enisaIdVendor":[{"id":"485a2ce7-1d3b-38ed-8dd2-4b9c842cfa0a","vendor":{"name":"zhenorzz"}}],"enisaIdVulnerability":[{"id":"2444075d-0909-389b-b3a5-123d41706580","vulnerability":{"id":"CVE-2026-114665","description":"Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.","datePublished":"Oct 22, 2026, 10:57:39 AM","dateUpdated":"Oct 29, 2026, 2:07:01 AM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/zhenorzz/goploy/commit/97a49839cc27470f4e804d985fbd2bddac085a3a\nhttps://github.com/zhenorzz/goploy/releases/tag/v1.18.1\nhttps://github.com/zhenorzz/goploy/blob/v1.18.0/cmd/server/api/deploy/handler.go#L404-L418\nhttps://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw\nhttps://github.com/zhenorzz/goploy\nhttps://www.vulncheck.com/advisories/goploy-1.18.0-before-1.18.1-symlink-following-arbitrary-file-read-via-deploy-filediff-and-deploy-filecompare\n","enisa_id":"EUVD-2026-108121\n","assigner":"VulnCheck","epss":0.35,"dataProcessed":"Oct 30, 2026, 3:00:41 AM","vulnerabilityProduct":[{"id":"d519559e-28f3-3182-afd9-448fe1dde7b7","product":{"name":"goploy","vendor":{"name":"zhenorzz"}},"product_version":"1.18.0 \u003c1.18.1"}],"vulnerabilityVendor":[{"id":"56fb9389-34f1-349f-9083-4227f8351c21","vendor":{"name":"zhenorzz"}}]}},{"id":"53022096-4261-3fd9-87bc-7004d7244e86","vulnerability":{"id":"GHSA-q5pp-jrgg-4fpm","description":"Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.","datePublished":"Oct 22, 2026, 12:31:16 PM","dateUpdated":"Oct 22, 2026, 12:31:16 PM","baseScore":0.0,"references":"https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114665\nhttps://github.com/zhenorzz/goploy/commit/97a49839cc27470f4e804d985fbd2bddac085a3a\nhttps://github.com/zhenorzz/goploy\nhttps://github.com/zhenorzz/goploy/blob/v1.18.0/cmd/server/api/deploy/handler.go#L404-L418\nhttps://github.com/zhenorzz/goploy/releases/tag/v1.18.1\nhttps://www.vulncheck.com/advisories/goploy-1.18.0-before-1.18.1-symlink-following-arbitrary-file-read-via-deploy-filediff-and-deploy-filecompare\n","enisa_id":"EUVD-2026-108121\n","aliases":"CVE-2026-114665\nGHSA-q5pp-jrgg-4fpm\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}