Advisories for Golang/Github.com/Zhenorzz/Goploy package

Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding model.ProjectFile.GetData and model.Project.GetData queries filter only by row id. A user holding the manager role (or any role that includes the FileSync / EditProject permission) in their own namespace can read, write, or delete files in …

Through this vulnerability, an attacker can bypass authorization to read any sensitive files on the host machine as well as all managed target servers. For example: Read /etc/passwd or /etc/shadow on the local or remote target servers to obtain host system user information. Read users' SSH private keys (e.g., ~/.ssh/id_rsa) across different systems, enabling passwordless SSH access to the host or cross-network connections to other servers to steal administrative control, …