Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Fix availableCritical · CVSS 9.6EPSS 0.35%

Published Jul 7, 2026 · updated Oct 27, 2026

What to do

  1. Upgrade to a fixed version: github.com/zhenorzz/goploy 1.18.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/zhenorzz/goploy

Vulnerable versions
<= 1.17.5
Fixed in
1.18.0

Check your project: go list -m all | grep github.com/zhenorzz/goploy

Sources

CWE-639 Authorization Bypass Through User-Controlled Key · CWE-863 Incorrect Authorization

← All critical vulnerabilities