CVE-2026-53553CWE-200CWE-22path-traversalinformation-disclosure

CVE-2026-53553

High · published August 31, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
39.3
In the wild
Unconfirmed
What it is

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00465 · 39.3th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-31T23:16Z
References (4)
http://github.com/zhenorzz/goploy/releases/tag/v1.18.0 · [email protected]https://github.com/zhenorzz/goploy/commit/d51aa15ebc0a474d9d71d6c453a0fe798dd5e007 · [email protected]https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw · [email protected]https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 SEP 03:37Z
    EPSS moved — → 0%
    epss
  • 31 AUG 18:46Z
    Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise
    cvelistv5