CVE-2026-118756: gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir
gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users of gopass before 1.17.0 who use a shared git-synced password store and have collaborators able to write entries are exposed. The risk arises when a collaborator can introduce crafted entry names into that shared store.
What interaction is required for exploitation?
An attacker needs to add entries containing ../ path components to the shared store. A victim must then run recursive deletion with gopass rm -r, which can cause deletion of directory trees outside the password store.
Are confidentiality or integrity impacts described?
The provided severity vector identifies availability impact as high, while confidentiality and integrity impacts are listed as none. The described consequence is deletion of arbitrary directory trees.
What version addresses the vulnerability?
The issue affects versions before 1.17.0. Version 1.17.0 is identified by the provided release reference as the fixed release.