gopass vulnerabilities

CVEs whose affected-version data names the gopass package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-118756Medium· 5.5

1w ago

gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access…

▾ Sunlitgopasspw · gopassEPSS 0.14%via CVEORG