CVE-2026-118756

Medium

Description

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.

SeverityMedium

CVSS5.5

Exploit probability—

ProductGopass

PublishedOct 28, 2026

First seenNov 4, 2026

Weakness typeCWE-22Path traversal

How to fix

Update

gopasspw gopass1.17.0 or later

Patches

github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2

Vendor advisories

Affected products

Product	Affected versions	Fixed in
gopasspw gopass	v < 1.17.0	1.17.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.