Executive brief
Goploy, a deployment and operations platform, contains a vulnerability that allows users with manager-level access in one project area (namespace) to access and modify projects in other areas. An attacker can use this to read, overwrite, or delete sensitive project files. Furthermore, by changing a project's source code location, an attacker can force the system to execute malicious code during the next deployment, potentially taking full control of the server.
Technical details
The vulnerability exists in the `Project.AddFile`, `Project.EditFile`, `Project.RemoveFile`, and `Project.Edit` handlers within `cmd/server/api/project/handler.go`. These endpoints accept project or file IDs from the JSON request body but fail to verify if the requested ID belongs to the authenticated user's namespace. An attacker with the `manager` role (possessing `FileSync` or `EditProject` permissions) can manipulate files across different namespaces. By using the `Project.Edit` handler to modify a project's git remote URL, an attacker can achieve RCE because the application executes `git remote set-url` on the project's working tree, leading to the execution of arbitrary code during the subsequent deployment process.
Affected products
- zhenorzz Goploy <= 1.17.5
Timeline
- 2026-05-27: other: Vulnerability verified against develop branch HEAD
- 2026-06-01: disclosed
- 2026-07-07: advisory