HIGH
zhenorzz
CVE published 2026-07-07
CVE-2026-114665
A severe path traversal vulnerability exists in Goploy's backend API endpoints, specifically `/deploy/fileDiff`, allowing for arbitrary file reads. This issue arises from insufficient validation and sanitization of the `filePath` parameter, enabling malicious paths containing `../` to be executed within the system. Consequently, an attacker can read any local host file, potentially leading to remote serve [truncated]