CVE-2026-114665
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-59
Incorrecta resolución de una ruta antes de aceder a un fichero (Seguimiento de enlaces)
Fecha de publicación:
22/10/2026
Última modificación:
22/10/2026
Descripción
*** Pendiente de traducción *** Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.
Impacto
Puntuación base 4.0
7.10
Gravedad 4.0
ALTA
Puntuación base 3.x
6.50
Gravedad 3.x
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/zhenorzz/goploy
- https://github.com/zhenorzz/goploy/blob/v1.18.0/cmd/server/api/deploy/handler.go#L404-L418
- https://github.com/zhenorzz/goploy/commit/97a49839cc27470f4e804d985fbd2bddac085a3a
- https://github.com/zhenorzz/goploy/releases/tag/v1.18.1
- https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw
- https://www.vulncheck.com/advisories/goploy-1.18.0-before-1.18.1-symlink-following-arbitrary-file-read-via-deploy-filediff-and-deploy-filecompare