CVE-2026-118756— gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir

Quick assessment

Affected

gopasspw gopass

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

gopass 1.17.0 之前的版本在文件系统存储后端中存在路径遍历漏洞。攻击者可通过在和函数中使用包含的条目名称，删除密码存储目录之外的目录。拥有共享 Git 同步存储库写入权限的协作者可植入恶意构造的条目，导致受害者在执行递归删除命令（）时，意外删除任意目录树。

CVSS 5.5 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1565.002 · Transmitted Data Manipulation T1565.001 · Stored Data Manipulation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir

Source: CVE Program / CVE List V5

Vulnerability Description

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
gopasspw	gopass	0 ~ 1.17.0	-

II. Public POCs for CVE-2026-118756

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118756

请登录查看更多情报信息。

Other References for CVE-2026-118756 (5)

https://github.com/gopasspw/gopass/blob/v1.16.1/internal/backend/storage/fs/store.go#L207-L226 technical-description
https://github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2 patch
https://github.com/gopasspw/gopass/releases/tag/v1.17.0 release-notes
https://github.com/gopasspw/gopass/security/advisories/GHSA-rw43-4vhf-hcvj vendor-advisory
https://www.vulncheck.com/advisories/gopass-before-1.17.0-path-traversal-via-fs-storage-prune-and-isdir third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-118756

IV. Related Vulnerabilities

Same weakness: CWE-22