{"id":"EUVD-2026-68726","enisaUuid":"c0cc9514-3fb1-37a3-969a-dec5fe6cdfe0","description":"Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.","datePublished":"Aug 31, 2026, 6:46:52 PM","dateUpdated":"Aug 31, 2026, 7:35:12 PM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw\nhttps://github.com/zhenorzz/goploy/commit/d51aa15ebc0a474d9d71d6c453a0fe798dd5e007\nhttp://github.com/zhenorzz/goploy/releases/tag/v1.18.0\n","aliases":"CVE-2026-53553\nGHSA-4g5x-hcwm-82jw\n","assigner":"GitHub_M","epss":0.47,"enisaIdProduct":[{"id":"f5e8db6d-047e-38f4-8550-9d5cca3e0855","product":{"name":"goploy","vendor":{"name":"zhenorzz"}},"product_version":"\u003c 1.18.0"}],"enisaIdVendor":[{"id":"a0a5e6d7-d2e6-3096-9614-77f548b804e1","vendor":{"name":"zhenorzz"}}],"enisaIdVulnerability":[{"id":"78662300-a4af-3856-be36-e20d2612d194","vulnerability":{"id":"GHSA-4g5x-hcwm-82jw","description":"Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise","datePublished":"Jul 7, 2026, 11:42:24 PM","dateUpdated":"Oct 27, 2026, 3:11:46 PM","baseScore":0.0,"references":"https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53553\nhttps://github.com/zhenorzz/goploy/commit/d51aa15ebc0a474d9d71d6c453a0fe798dd5e007\nhttps://github.com/zhenorzz/goploy\nhttp://github.com/zhenorzz/goploy/releases/tag/v1.18.0\n","enisa_id":"EUVD-2026-68726\n","aliases":"GHSA-4g5x-hcwm-82jw\nCVE-2026-53553\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 11:01:28 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fe9d0a95-0fc4-3722-9b6a-0b4cc90e0125","vulnerability":{"id":"CVE-2026-53553","description":"Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.","datePublished":"Aug 31, 2026, 6:46:52 PM","dateUpdated":"Aug 31, 2026, 7:35:12 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw\nhttps://github.com/zhenorzz/goploy/commit/d51aa15ebc0a474d9d71d6c453a0fe798dd5e007\nhttp://github.com/zhenorzz/goploy/releases/tag/v1.18.0\n","enisa_id":"EUVD-2026-68726\n","assigner":"GitHub_M","epss":0.47,"dataProcessed":"Oct 30, 2026, 7:16:47 AM","vulnerabilityProduct":[{"id":"0023b757-2e99-35f6-b718-ffbd3e677987","product":{"name":"goploy","vendor":{"name":"zhenorzz"}},"product_version":"\u003c 1.18.0"}],"vulnerabilityVendor":[{"id":"3e786a78-1e33-3707-969e-6e03d62e1bb6","vendor":{"name":"zhenorzz"}}]}}],"enisaIdAdvisory":[]}