{"id":"CVE-2026-118756","title":"gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir","summary":"gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-22"],"vendor":"gopasspw","product":"gopass","affected":["gopass < 1.17.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T16:26:12.193166Z"},"published":"2026-10-28","updated":"2026-11-05","sourceUpdated":"2026-11-05T16:26:19.071Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118756","references":[{"url":"https://github.com/gopasspw/gopass/security/advisories/GHSA-rw43-4vhf-hcvj","label":"GitHub Security Advisory (GHSA-rw43-4vhf-hcvj)"},{"url":"https://github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2"},{"url":"https://github.com/gopasspw/gopass/releases/tag/v1.17.0","label":"gopass v1.17.0 Release Notes"},{"url":"https://github.com/gopasspw/gopass/blob/v1.16.1/internal/backend/storage/fs/store.go#L207-L226"},{"url":"https://www.vulncheck.com/advisories/gopass-before-1.17.0-path-traversal-via-fs-storage-prune-and-isdir","label":"VulnCheck Advisory: gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir"}],"tags":["cve.org"],"epss":0.00145,"epssPercentile":0.03754,"ingestedAt":"2026-10-30T21:09:21.617Z","slug":"CVE-2026-118756","body":"## Overview\n\ngopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.\n\n## Affected\n\n- `gopass < 1.17.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}