# github.com/zhenorzz/goploy (Go) vulnerabilities 3 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.18.1 (Oct 20, 2026): affected by 3 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 63 since v1.0.1 (Aug 4, 2020) - Registry: https://pkg.go.dev/github.com/zhenorzz/goploy - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-114665: v1.0.1 to v1.18.1 (through the newest release) - CVE-2026-53553: v1.0.1 to v1.18.1 (through the newest release) - CVE-2026-53552: v1.0.1 to v1.18.1 (through the newest release) ## Advisories (3) ### [CVE-2026-114665](https://cve.now/CVE-2026-114665): Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare - Severity: High 7.1 - Published: Oct 22, 2026 - Affected: all versions; fixed in 1.18.0. - No fix released. The latest release, v1.18.1, is still affected. ### [CVE-2026-53553](https://cve.now/CVE-2026-53553): Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise - Severity: High 7.7 - Published: Aug 31, 2026 - Affected: all versions; fixed in 1.18.0. - No fix released. The latest release, v1.18.1, is still affected. ### [CVE-2026-53552](https://cve.now/CVE-2026-53552): Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project\_file handlers - Severity: Critical 9.6 - Published: Aug 31, 2026 - Affected: fixed in 1.18.0; all versions. - No fix released. The latest release, v1.18.1, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/zhenorzz/goploy Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.