Is CVE-2026-114665 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-114665?

CVE-2026-114665 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-114665

Description

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read database configuration and deployment SSH private keys.