Goploy, an open-source automation deployment system, has a severe path traversal flaw in the /deploy/fileDiff API endpoint that allows an attacker to read arbitrary files on the server, potentially exposing sensitive data and enabling further exploitation. The vulnerability arises from insufficient validation of client‑supplied file paths, leading to information disclosure (CWE‑200) and path traversal (CWE‑22). An attacker who can send crafted requests to the API can retrieve any file readable by the process, including configuration files, credentials, or system binaries, thereby compromising the entire server.

The flaw affects all versions of Goploy older than 1.18.0. The product is maintained by the vendor zhenorzz and is available as open-source software. Users running any pre‑1.18.0 release are susceptible.

The CVSS score of 7.7 indicates a high severity vulnerability that can be exploited remotely over the network when the /deploy/fileDiff endpoint is reachable. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves sending a malicious request to the HTTP API from an external host, making the exploitation feasible in a connected network environment.