A high-severity path traversal vulnerability in the Goploy deployment system allows authenticated users to access sensitive files on the host server.

This is a path traversal vulnerability (CWE-22) located in the /deploy/fileDiff backend API endpoint. The application fails to properly sanitize user-supplied file paths, allowing an attacker with low-level authenticated access to bypass directory restrictions and read sensitive files outside the intended scope.

The ability to perform arbitrary file reads can lead to the exposure of sensitive configuration files, environment variables, or credentials stored on the deployment server. Given the CVSS score of 7.7, this represents a significant risk to the confidentiality of the infrastructure, potentially facilitating further lateral movement or full system compromise.

Immediate Action: Upgrade the Goploy installation to version 1.18.0 or later to ensure the path validation logic is properly implemented.

Proactive Monitoring: Review application access logs for unusual patterns or attempts to access system files, such as those containing dot-dot-slash (../) sequences in the /deploy/fileDiff request parameters.

Compensating Controls: Implement strict network segmentation and apply Web Application Firewall (WAF) rules to filter and block requests containing directory traversal sequences directed at the /deploy/fileDiff endpoint.

Public Exploit Available: No (Exploit available: unknown)

The vulnerability presents a clear risk to server integrity and data confidentiality. Administrators must prioritize updating to version 1.18.0 immediately. In environments where an immediate update is not feasible, restrict access to the deployment management interface to trusted users only and employ WAF filtering to mitigate potential exploitation attempts.