goploy vulnerabilities

2 known vulnerabilities in goploy from Zhenorzz. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.7 High severity

  goploy: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-53553Aug 31, 2026Zhenorzz

  Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue

• 9.6 Critical severity

  goploy: Authorization Bypass Through User-Controlled Key

  CVE-2026-53552Aug 31, 2026Zhenorzz

  Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act