CVE-2026-118756 gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118756?
CVE-2026-118756 is a medium-severity vulnerability in gopasspw gopass, published on 28 Oct 2026.
Official description
gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.
Weakness: CWE-22
Which versions are affected by CVE-2026-118756?
How do I fix CVE-2026-118756?
No fix has been published for CVE-2026-118756 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118756 being exploited?
There is no known exploitation of CVE-2026-118756 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-118756, GHSA-g69m-c6cf-wpcv, GHSA-rw43-4vhf-hcvj, UBUNTU-CVE-2026-118756.