CVE-2026-53553: Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

Through this vulnerability, an attacker can bypass authorization to read any sensitive files on the host machine as well as all managed target servers. For example:

• Read /etc/passwd or /etc/shadow on the local or remote target servers to obtain host system user information.
• Read users’ SSH private keys (e.g., ~/.ssh/id_rsa) across different systems, enabling passwordless SSH access to the host or cross-network connections to other servers to steal administrative control, achieving the equivalent of Remote Code Execution (RCE).
• By enumerating the serverID, an attacker can use Goploy as a jump server (bastion host) to conduct large-scale information theft against all bound deployment target systems.
• Obtain various critical configuration files, database credentials, etc., of the affected systems.