The vulnerability is a link following bug in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated users with write access to a repository to read arbitrary files on the host. An attacker can create a symlink that points outside the project directory and use these endpoints to retrieve sensitive files such as database configuration or deployment SSH private keys. The weakness is a classic arbitrary file read (CWE-59). This leads to a confidentiality breach if the attacker can extract credentials or configuration details.

The affected software is the Goploy application produced by Vendor zhenorzz, specifically versions 1.18.0 through the release before 1.18.1. Any installation of these versions running the /deploy/fileDiff or /deploy/fileCompare endpoints is vulnerable.

The CVSS score of 7.1 indicates a medium-to-high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be authenticated HTTP requests to the /deploy/fileDiff or /deploy/fileCompare REST endpoints. Attackers require repository write permissions, a privilege level that is common for developers, which lowers the barrier for exploitation. No public exploit has been reported, but the straightforward nature of the vulnerability could lead to swift exploitation if not mitigated. Organizations should treat this vulnerability as a moderate-to-high risk and address it promptly.