Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Goploy System Arbitrary File Read Vulnerability Basic Information - Vulnerability Name: Goploy Endpoints Arbitrary File Read via Path Traversal - Affected Product: Goploy - Known Affected Versions: " \ -H "Content-Type: application/json" \ -H "G-N-ID: 1" \ -d '{"projectId":1,"serverId":1,"filePath":"../../../../../../../../../../etc/passwd"}' \ "http:// /deploy/fileDiff" ``` 3. Reproduction Result The server will return the complete contents of the `/etc/passwd` file from both the host and the remote server. Concrete Steps 1. Environment Setup Published an arbitrary project using the super admin account: Configured two managed remote servers: Created a normal user and assigned the `member` role (which includes File Compare permission): 2. Obtain Normal User Privileges Log in to the system using the registered `test` account to obtain valid authentication credentials (Cookie/Token). 3. Execute poc.py (See below) * Parameter Explanation: `-u` :…
Recommended action: Upgrade to 1.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
`Project.AddFile`, `Project.EditFile`, `Project.RemoveFile`, and `Project.Edit` in `cmd/server/api/project/handler.go` accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding `model.ProjectFile.GetData` and `model.Project.GetData` queries filter only by row id. A user holding the `manager` role (or any role that includes the `FileSync` / `EditProject` permission) in their own namespace can read, write, or delete files in any project across the install, and can rewrite any project's git remote URL by submitting the foreign id in the body. The git-URL primitive escalates to RCE on the next deploy because `Edit` runs `git remote set-url` on the project's working tree. Affected `zhenorzz/goploy` `develop` HEAD as of 2026-05-27. Verified against the `zhenorzz/goploy:1.17.5` Docker image…
Recommended action: Upgrade to 1.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.