{"schema":"threatline.record/2","record":{"id":"CVE-2026-114665","aliases":["CVE-2026-53553","GHSA-4g5x-hcwm-82jw","GO-2026-5938"],"summary":"Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare","details":"Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.","categories":["Libraries & packages"],"product":"goploy","vendor":"zhenorzz","ecosystem":"Go","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114665","source_modified_at":"2026-10-22T10:57:39.553Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"goploy","vendor":"zhenorzz","versions":[{"lessThan":"1.18.1","status":"affected","version":"1.18.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4g5x-hcwm-82jw","source_modified_at":"2026-10-23T02:55:59.233579620Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"github.com/zhenorzz/goploy","ecosystem":"Go","purl":"pkg:golang/github.com/zhenorzz/goploy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.17.5"}]}],"versions":[]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114665","source_modified_at":"2026-10-22T10:57:39.553Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"goploy","ecosystem":null},"version":"1.18.1","basis":"first unaffected version stated in the CVE record"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00353,"percentile":0.27826,"score_date":"2026-10-23"},"published_at":"2026-10-22T10:57:39.553Z","modified_at":"2026-10-23T02:55:59.233579620Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-114665","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T10:57:39.553Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-4g5x-hcwm-82jw","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-23T02:55:59.233579620Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114665","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/zhenorzz/goploy/commit/97a49839cc27470f4e804d985fbd2bddac085a3a","tags":["patch"]},{"source":"CVE List","url":"https://github.com/zhenorzz/goploy/releases/tag/v1.18.1","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/zhenorzz/goploy/blob/v1.18.0/cmd/server/api/deploy/handler.go#L404-L418","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw","tags":["related","vendor-advisory"]},{"source":"CVE List","url":"https://github.com/zhenorzz/goploy","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/goploy-1.18.0-before-1.18.1-symlink-following-arbitrary-file-read-via-deploy-filediff-and-deploy-filecompare","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T02:55:59.233579620Z","content_hash":"203526f0d269b629d29f8892c0ff6311c91239cce64d11425ccd90b47afdceba"}}