CVE-2026-114665 zhenorzz CVE debrief

Who should care

System administrators and security teams responsible for Goploy deployments should assess exposure and prioritize remediation. This vulnerability may impact organizations using Goploy for automation deployment, particularly those with publicly accessible `/deploy/fileDiff` endpoints.

Why it matters

CVE-2026-114665 is a high-severity path traversal vulnerability in Goploy's `/deploy/fileDiff` endpoint, allowing for arbitrary file reads. Defenders should prioritize patching, implement input validation, and monitor for suspicious activity to prevent potential remote server compromise.

• Potential unauthorized access to sensitive files
• Possible remote server compromise through exploitation
• Need for urgent patching or mitigation to prevent exploitation
• Requirement for thorough inventory checks and monitoring

Technical summary

The Goploy system's backend API endpoint `/deploy/fileDiff` is vulnerable to path traversal attacks. This endpoint, intended for file comparison, fails to properly validate and sanitize the `filePath` parameter. As a result, attackers can manipulate this parameter to read arbitrary files on the local host, potentially leading to remote server compromise. The vulnerability exists due to insufficient validation and sanitization of the `filePath` parameter, allowing malicious paths containing `../` to be executed within the system.

Defensive priority

High

Recommended defensive actions

• Review and update Goploy to a version beyond 1.17.5
• Implement strict input validation and sanitization for the `filePath` parameter
• Monitor `/deploy/fileDiff` endpoint for suspicious activity
• Consider compensating controls such as Web Application Firewalls (WAFs)
• Perform thorough inventory checks and monitoring
• Track exceptions and retest remediated assets
• Review relevant logs for exposed assets that need extra review

Evidence notes

The vulnerability is confirmed in Goploy versions <=1.17.5. The `/deploy/fileDiff` endpoint is susceptible to path traversal attacks due to inadequate input validation. This issue arises from insufficient validation and sanitization of the `filePath` parameter, enabling malicious paths containing `../` to be executed within the system. Consequently, an attacker can read any local host file, potentially leading to remote server compromise. To verify, defenders should review the affected product deployments, assess exposure, and monitor

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.