Medium 6.7

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend...

CVE-2026-118756 First seen on SecPulse 06:11

Affected packages

Ecosystem	Package	Affected	Fixed
gopasspw	gopass	< 1.17.0	1.17.0

Original description The description as published by the source.

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.5; CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4: Medium 6.7; CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Published: Oct 29, 2026
First seen on SecPulse: 06:11
GHSA: GHSA-g69m-c6cf-wpcv
CWE: CWE-22

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Path Traversal

CWE

CWE-22

All

Gopasspw Gopass

Detection sources

NIST National Vulnerability Database07:17
GitHub Security Advisories (Global)09:31
CVE.org (CVE Program・cvelistV5)06:11