Symlink Following Vulnerability in Goploy by Zhenorzz

CVE-2026-114665

What is CVE-2026-114665?

Goploy version 1.18.0 contains a vulnerability that allows authenticated users with write access to repositories to exploit the /deploy/fileDiff and /deploy/fileCompare endpoints. This issue permits attackers to create symbolic links that point outside the intended project directory, potentially exposing sensitive information such as database configuration files and SSH private keys used for deployment. This represents a significant risk if exploited, as it can lead to unauthorized access to critical infrastructure components.

References