Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-118756gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir

Medium 5.5

In plain English

A medium-severity path traversal in gopass from gopasspw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.1%top 96.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	golang-github-gopasspw-gopass	no fix listed	DEBIAN-CVE-2026-118756
Ubuntu:22.04:LTS	gopass	no fix listed	UBUNTU-CVE-2026-118756
Ubuntu:24.04:LTS	gopass	no fix listed	UBUNTU-CVE-2026-118756

Affected products (as reported)

Vendor	Product	Versions
gopasspw	gopass	0 – before 1.17.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-rw43-4vhf-hcvj) vendor-advisory
https://github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2 patch
gopass v1.17.0 Release Notes release-notes
https://github.com/gopasspw/gopass/blob/v1.16.1/internal/backend/storage/fs/store.go#L207-L226 technical-description
VulnCheck Advisory: gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir third-party-advisory