UBUNTU-CVE-2026-118756: Medium severity ubuntu/gopass vulnerability
gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.
Affected Software
Frequently Asked Questions
Which installations require remediation?
gopass versions before 1.17.0 are affected.
Who can trigger the issue, and what user action is required?
A collaborator with write access to a shared Git-synchronized password store can add crafted entries. Exploitation requires a victim to run a recursive gopass rm -r operation against that store.
What is the practical impact?
The crafted entries can cause deletion of arbitrary directory trees outside the password store. The reported impact is availability loss; no confidentiality or integrity impact is listed.