Path Traversal Vulnerability in gopass Filesystem Storage Backend

CVE-2026-118756

What is CVE-2026-118756?

The filesystem storage backend of gopass prior to version 1.17.0 has a path traversal issue that enables attackers to manipulate entries. Specifically, an attacker with write access to a shared git-synced store can craft entry names using '../', which the commands Prune and IsDir do not adequately validate. This design flaw allows a victim who inadvertently executes a recursive gopass rm -r command to delete arbitrary directories outside the intended password store, leading to potential data loss and disruption.

References