Vulnerability Description
gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/gopasspw/gopass/blob/v1.16.1/internal/backend/storage/fs/stor
- https://github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0
- https://github.com/gopasspw/gopass/releases/tag/v1.17.0
- https://github.com/gopasspw/gopass/security/advisories/GHSA-rw43-4vhf-hcvj
- https://www.vulncheck.com/advisories/gopass-before-1.17.0-path-traversal-via-fs-
FAQ
What is CVE-2026-118756?
CVE-2026-118756 is a vulnerability with a CVSS score of 5.5 (MEDIUM). gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and I...
How severe is CVE-2026-118756?
CVE-2026-118756 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-118756?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.