CVE-2026-118756

Name of the Vulnerable Software and Affected Versions gopass versions prior to 1.17.0

Description A path traversal issue exists in the filesystem storage backend. This allows attackers to delete directories outside the password store by using ../ entry names within the Prune and IsDir functions. Collaborators with write access to a shared git-synced store can introduce crafted entries, which may lead to the deletion of arbitrary directory trees when a victim performs a recursive gopass rm -r operation.

Recommendations Update to version 1.17.0 or later.