Live › vulnerability › CVE-2026-118756
Go to dashboardgopass before 1.17.0 has a path traversal flaw in its filesystem storage backend, where ../ entry names are not rejected by Prune and IsDir. A collaborator with write access to a shared git-synced password store can plant crafted entries so that a victim's recursive gopass rm -r deletes directory trees outside the store.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Teams and individuals who use gopass with the filesystem storage backend on a password store that is shared through git, where other people have write access. A solo user with a private store that nobody else can write to is not exposed to this attacker path.
No product ranges from the sources yet.
gopass version and confirm the installed version is below 1.17.0.1.17.0 or later.gopass rm -r on shared stores and review incoming git changes to the store for entries containing ../.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.
This page as .md · .json · in your agent: get_signal("CVE-2026-118756")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.