CVE-2026-118756GHSA-rw43-4vhf-hcvj
gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir
gopasspw gopass
CVSS
6.7MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.17.0gopassCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.
Text from CVE List
Affected versions 1
- gopassaffected: all versions before 1.17.0CVE List
References 5
- github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2Fixvia CVE List
- github.com/gopasspw/gopass/releases/tag/v1.17.0Fixvia CVE List
- github.com/gopasspw/gopass/security/advisories/GHSA-rw43-4vhf-hcvjAdvisoryvia CVE List
- vulncheck.com/advisories/gopass-before-1.17.0-path-traversal-via-fs-storage-prune-and-isdirAdvisoryvia CVE List
- github.com/gopasspw/gopass/blob/v1.16.1/internal/backend/storage/fs/store.go#L207-L226Referencevia CVE List