CVE-2026-118756 Details
Description
gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.
A path traversal vulnerability has been identified in gopass versions prior to 1.17.0, specifically within the filesystem storage backend. This vulnerability allows attackers to delete directories outside the designated password store by using entry names that include '../' sequences. The issue arises in the 'Prune' and 'IsDir' functions, which do not properly validate paths before execution. Collaborators with write access to a shared, git-synced store can exploit this vulnerability by introducing crafted entries that, when deleted recursively, cause the deletion of arbitrary directory trees on the victim's system.
Users can update gopass to version 1.17.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gopasspw/gopass/blob/v1.16.1/internal/backend/storage/fs/store.go#L207-L226 | [email protected] | Source CodeVendor |
| https://github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2 | [email protected] | Source CodeVendor |
| https://github.com/gopasspw/gopass/releases/tag/v1.17.0 | [email protected] | Release NotesVendor |
| https://github.com/gopasspw/gopass/security/advisories/GHSA-rw43-4vhf-hcvj | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/gopass-before-1.17.0-path-traversal-via-fs-storage-prune-and-isdir | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gopass | <= 1.16.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |