{"id":"CVE-2026-118756","kind":"vulnerability","aliases":["CVE-2026-118756"],"related":[],"title":"gopass: path traversal lets a store collaborator delete arbitrary directories","description":"gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.","summary":"gopass before 1.17.0 has a path traversal flaw in its filesystem storage backend, where ../ entry names are not rejected by Prune and IsDir. A collaborator with write access to a shared git-synced password store can plant crafted entries so that a victim's recursive gopass rm -r deletes directory trees outside the store.","severity":"medium","cvss":6.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["git","gopass","package","self-hosted","shared-password-store"],"not_affected_if":["gopass-1.17.0-or-later","no-recursive-rm-use","single-user-store"],"how_to_check":"- Run `gopass version` and confirm the installed version is below `1.17.0`.\n- Check whether your password store is shared with other people through a git remote that others can write to.","fix":"- Upgrade gopass to `1.17.0` or later.\n- Until upgraded, avoid running `gopass rm -r` on shared stores and review incoming git changes to the store for entries containing `../`.","status":"open","published_at":"2026-10-28T22:17:14+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","triaged_at":"2026-10-28T22:36:54+00:00","updated_at":"2026-10-28T22:36:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T22:36:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade gopass to `1.17.0` or later.\n- Until upgraded, avoid running `gopass rm -r` on shared stores and review incoming git changes to the store for entries containing `../`.","reach":"network","title":"gopass: path traversal lets a store collaborator delete arbitrary directories","impact":"medium","summary":"gopass before 1.17.0 has a path traversal flaw in its filesystem storage backend, where ../ entry names are not rejected by Prune and IsDir. A collaborator with write access to a shared git-synced password store can plant crafted entries so that a victim's recursive gopass rm -r deletes directory trees outside the store.","category":"package","nicknames":[],"who_cares":["gopass","self-hosted","shared-password-store","git"],"confidence":0.7,"needs_auth":"yes","worst_case":"Victim's recursive removal deletes arbitrary directory trees outside the store.","analyst_note":"","how_to_check":"- Run `gopass version` and confirm the installed version is below `1.17.0`.\n- Check whether your password store is shared with other people through a git remote that others can write to.","needs_analyst":false,"not_affected_if":["single-user-store","gopass-1.17.0-or-later","no-recursive-rm-use"],"who_is_affected":"Teams and individuals who use gopass with the filesystem storage backend on a password store that is shared through git, where other people have write access. A solo user with a private store that nobody else can write to is not exposed to this attacker path.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000612,"input_tokens":3342,"output_tokens":555,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118756':13A,16A '-2026':12A,15A '1.17.0':29B,84C 'access':54B,115C 'allow':96C 'arbitrari':9A,137C 'attack':97C 'backend':39B,94C 'caus':127C 'collabor':7A,51B,112C 'contain':85C 'craft':65B,125C 'cve':11A,14A 'delet':8A,76B,99C,136C 'directori':10A,77B,100C,138C 'entri':41B,66B,106C,126C 'filesystem':37B,92C 'flaw':34B 'git':17B,59B,120C 'git-sync':58B,119C 'gopass':1A,18B,27B,73B,82C,132C 'host':22B 'introduc':124C 'isdir':49B,111C 'let':4A 'name':42B,107C 'outsid':79B,101C 'packag':19B 'password':25B,61B,103C 'path':2A,32B,87C 'plant':64B 'prune':47B,109C 'r':75B,134C 'recurs':72B,131C 'reject':45B 'rm':74B,133C 'self':21B 'self-host':20B 'share':24B,57B,118C 'shared-password-stor':23B 'storag':38B,93C 'store':6A,26B,62B,81B,104C,122C 'sync':60B,121C 'travers':3A,33B,88C 'tree':78B,139C 'via':105C 'victim':70B,129C 'vulner':89C 'write':53B,114C","nicknames":[],"mitigations":[],"who_affected":"Teams and individuals who use gopass with the filesystem storage backend on a password store that is shared through git, where other people have write access. A solo user with a private store that nobody else can write to is not exposed to this attacker path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118756","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118756","severity":null,"published_at":"2026-10-28T22:17:14+00:00","modified_at":"2026-10-28T22:17:14+00:00","first_seen_at":"2026-10-28T22:35:34+00:00","fetched_at":"2026-10-28T22:35:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}