CVE-2026-118756
gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.
| CWE | CWE-22 |
| Vendor | gopasspw |
| Product | gopass |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for gopasspw gopass
Be the first to know when new medium vulnerabilities affecting gopasspw gopass are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
gopasspw / gopass
0 < 1.17.0
References
github.com: https://github.com/gopasspw/gopass/security/advisories/GHSA-rw43-4vhf-hcvj github.com: https://github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2 github.com: https://github.com/gopasspw/gopass/releases/tag/v1.17.0 github.com: https://github.com/gopasspw/gopass/blob/v1.16.1/internal/backend/storage/fs/store.go#L207-L226 vulncheck.com: https://www.vulncheck.com/advisories/gopass-before-1.17.0-path-traversal-via-fs-storage-prune-and-isdir
Credits
George Chen