# CVE-2026-53552: zhenorzz Goploy IDOR and RCE in project handlers

Source: https://junglewise.ai/threats/cve-2026-53552-zhenorzz-goploy-idor-and-rce-in-project-handlers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-53552 · Severity: critical · CVSS 9.6 · Published 2026-08-31

Goploy, a deployment and operations platform, contains a vulnerability that allows users with manager-level access in one project area (namespace) to access and modify projects in other areas. An attacker can use this to read, overwrite, or delete sensitive project files. Furthermore, by changing a project's source code location, an attacker can force the system to execute malicious code during the next deployment, potentially taking full control of the server.

Technologies: [Zhenorzz Goploy](https://junglewise.ai/threats/technologies/goploy). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Zhenorzz](https://junglewise.ai/threats/vendors/zhenorzz).

## Quick answers

**Is CVE-2026-53552 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53552 being exploited in the wild.

**How severe is CVE-2026-53552?** Critical severity, with a CVSS score of 9.6, published 31 August 2026.

**Which products and versions are affected?** github.com/zhenorzz/goploy (Go) <= 1.17.5, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.17.5; Zhenorzz Goploy <= 1.17.5.

**Is there a fix for CVE-2026-53552?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53552 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53552?** Check whether you run github.com/zhenorzz/goploy (Go) or Zhenorzz Goploy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `Project.AddFile`, `Project.EditFile`, `Project.RemoveFile`, and `Project.Edit` handlers within `cmd/server/api/project/handler.go`. These endpoints accept project or file IDs from the JSON request body but fail to verify if the requested ID belongs to the authenticated user's namespace. An attacker with the `manager` role (possessing `FileSync` or `EditProject` permissions) can manipulate files across different namespaces. By using the `Project.Edit` handler to modify a project's git remote URL, an attacker can achieve RCE because the application executes `git remote set-url` on the project's working tree, leading to the execution of arbitrary code during the subsequent deployment process.

## Affected products

- zhenorzz Goploy <= 1.17.5

## Identifiers

- CVE-2026-53552
- GHSA-26rh-24rg-j3vv
- GO-2026-5936

## Timeline

- 2026-05-27: other: Vulnerability verified against develop branch HEAD
- 2026-06-01: disclosed
- 2026-07-07: advisory

## References

- [https://api.github.com/users/tonghuaroot](https://api.github.com/users/tonghuaroot)
- [https://github.com/tonghuaroot](https://github.com/tonghuaroot)
- [https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D](https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D)
- [https://api.github.com/users/tonghuaroot/repos](https://api.github.com/users/tonghuaroot/repos)
- [https://avatars.githubusercontent.com/u/23011166?v=4](https://avatars.githubusercontent.com/u/23011166?v=4)
- [https://api.github.com/users/tonghuaroot/events%7B/privacy%7D](https://api.github.com/users/tonghuaroot/events%7B/privacy%7D)

## Related threats

- [Goploy symlink following vulnerability in file diff endpoints](https://junglewise.ai/threats/cve-2026-114665-goploy-1-18-0-before-1-18-1-contains-a-link-following)
- [Goploy path traversal arbitrary file read in /deploy/fileDiff](https://junglewise.ai/threats/cve-2026-53553-goploy-path-traversal-arbitrary-file-read-in-deploy-filediff)