CVE-2026-118756 in gopass
Summary
by MITRE • 10/28/2026
gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in versions of gopass prior to 1.17.0 represents a critical path traversal flaw within the filesystem storage backend, specifically affecting operations that handle directory structures and pruning mechanisms. This security defect allows an attacker with write access to a shared git-synced password store to manipulate internal state by introducing crafted entries containing relative parent directory references such as ../ in their names. When these maliciously named entries are processed during standard maintenance or cleanup routines like the Prune function or directory existence checks via IsDir, the application fails to adequately sanitize or validate the resulting file paths against a secure base root. Consequently, this lack of input validation enables arbitrary directory deletion outside the intended password store boundaries, potentially leading to data loss or system instability depending on the permissions under which gopass is executed and the proximity of sensitive directories within the filesystem hierarchy.
From an operational perspective, the impact of this vulnerability is severe due to its reliance on social engineering or compromise of shared repositories rather than direct network exploitation. Collaborators who possess write access to a shared git-synced store can inject these malicious entries without triggering immediate suspicion if they mimic legitimate password entry structures. The actual damage occurs when another user with administrative privileges executes recursive removal commands such as gopass rm -r, which traverses the directory tree and processes all contained items including those injected by the attacker. This chain of events results in the deletion of arbitrary directory trees on the victim's local machine, potentially erasing critical configuration files, application data, or other sensitive information stored outside the designated password vault. The risk is amplified in team environments where trust assumptions regarding shared repository integrity may lead to lax verification practices before performing bulk deletions.
This vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-78 OS Command Injection if the underlying implementation invokes shell commands for deletion, though it primarily manifests as an insecure direct object reference leading to unauthorized file system modification. In terms of attack classification under MITRE ATT&CK, this behavior corresponds to T1083 File and Directory Discovery combined with T1485 Data Destruction, specifically illustrating how application logic flaws can be leveraged for destructive outcomes through legitimate administrative functions. The exploitation vector emphasizes the importance of strict input validation in tools that handle sensitive data storage, particularly when those tools support collaborative workflows involving version control systems where content integrity cannot always be guaranteed by default trust models.
Mitigation strategies must focus on immediate software updates and enhanced operational controls. Users should upgrade to gopass version 1.17.0 or later immediately, as this release includes patches that enforce strict path canonicalization and validation before processing any directory operations. Until the update is applied, administrators of shared repositories should implement rigorous code review processes for all new entries added via git commits, ensuring no relative path traversals are present in entry names. Additionally, organizations should consider restricting write access to critical password stores or implementing pre-commit hooks that automatically reject entries containing suspicious patterns such as ../ sequences. Regular audits of the filesystem state and backups of important data outside the gopass directory structure provide a necessary safety net against accidental or malicious deletion events resulting from this class of vulnerability.