GoPackage

github.com/zhenorzz/goploy

3 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release: v1.18.1 (Oct 20, 2026): affected by 3 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 1 critical, 2 high

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-114665High 7.1
Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare
Affected: all versions; fixed in 1.18.0.
No fix released. The latest release, v1.18.1, is still affected.
CVE-2026-53553High 7.7
Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise
Affected: all versions; fixed in 1.18.0.
No fix released. The latest release, v1.18.1, is still affected.
CVE-2026-53552Critical 9.6
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
Affected: fixed in 1.18.0; all versions.
No fix released. The latest release, v1.18.1, is still affected.