CVE-2026-118756

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118756", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-28T19:13:09.837Z", "datePublished": "2026-10-28T21:11:24.270Z", "dateUpdated": "2026-11-05T16:26:19.071Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-28T21:11:24.270Z"}, "datePublic": "2026-08-12T00:00:00.000Z", "title": "gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir", "descriptions": [{"lang": "en", "value": "gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "affected": [{"vendor": "gopasspw", "product": "gopass", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.17.0", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/gopasspw/gopass", "repo": "https://github.com/gopasspw/gopass"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.7, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/gopasspw/gopass/security/advisories/GHSA-rw43-4vhf-hcvj", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-rw43-4vhf-hcvj)"}, {"url": "https://github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2", "tags": ["patch"]}, {"url": "https://github.com/gopasspw/gopass/releases/tag/v1.17.0", "tags": ["release-notes"], "name": "gopass v1.17.0 Release Notes"}, {"url": "https://github.com/gopasspw/gopass/blob/v1.16.1/internal/backend/storage/fs/store.go#L207-L226", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/gopass-before-1.17.0-path-traversal-via-fs-storage-prune-and-isdir"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T16:26:12.193166Z", "id": "CVE-2026-118756", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:26:19.071Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118756", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T16:26:12.193166Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T16:26:16.400Z"}}], "cna": {"title": "gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/gopasspw/gopass", "vendor": "gopasspw", "product": "gopass", "versions": [{"status": "affected", "version": "0", "lessThan": "1.17.0", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/gopasspw/gopass", "defaultStatus": "unaffected"}], "datePublic": "2026-08-12T00:00:00.000Z", "references": [{"url": "https://github.com/gopasspw/gopass/security/advisories/GHSA-rw43-4vhf-hcvj", "name": "GitHub Security Advisory (GHSA-rw43-4vhf-hcvj)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2", "tags": ["patch"]}, {"url": "https://github.com/gopasspw/gopass/releases/tag/v1.17.0", "name": "gopass v1.17.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/gopasspw/gopass/blob/v1.16.1/internal/backend/storage/fs/store.go#L207-L226", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/gopass-before-1.17.0-path-traversal-via-fs-storage-prune-and-isdir", "name": "VulnCheck Advisory: gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-28T21:11:24.270Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118756", "state": "PUBLISHED", "dateUpdated": "2026-11-05T16:26:19.071Z", "dateReserved": "2026-10-28T19:13:09.837Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-28T21:11:24.270Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/gopasspw/gopass", "product": "gopass", "repo": "https://github.com/gopasspw/gopass", "vendor": "gopasspw", "versions": [{"lessThan": "1.17.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees."}], "id": "CVE-2026-118756", "lastModified": "2026-11-05T17:17:55.693", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118756", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T16:26:12.193166Z", "version": "2.0.3"}}]}, "published": "2026-10-28T22:17:14.523", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/gopasspw/gopass/blob/v1.16.1/internal/backend/storage/fs/store.go#L207-L226"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/gopasspw/gopass/releases/tag/v1.17.0"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/gopasspw/gopass/security/advisories/GHSA-rw43-4vhf-hcvj"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/gopass-before-1.17.0-path-traversal-via-fs-storage-prune-and-isdir"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/gopasspw/gopass: gopass: Arbitrary directory deletion via path traversal", "id": "2563203", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563203"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.", "A flaw was found in gopass. A path traversal vulnerability in the filesystem storage backend allows directory traversal sequences to escape storage boundaries. An attacker with write access to a shared password store can introduce crafted entry names, causing arbitrary directories outside the intended store to be deleted when a user performs a recursive removal command."], "name": "CVE-2026-118756", "public_date": "2026-10-28T21:11:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118756\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118756\nhttps://github.com/gopasspw/gopass/blob/v1.16.1/internal/backend/storage/fs/store.go#L207-L226\nhttps://github.com/gopasspw/gopass/commit/4f76ed537d8293ab88959a31a932dd9b3112a0a2\nhttps://github.com/gopasspw/gopass/releases/tag/v1.17.0\nhttps://github.com/gopasspw/gopass/security/advisories/GHSA-rw43-4vhf-hcvj\nhttps://www.vulncheck.com/advisories/gopass-before-1.17.0-path-traversal-via-fs-storage-prune-and-isdir"], "statement": "This vulnerability is rated as having Moderate impact because exploitation requires collaborator access to modify a shared repository alongside explicit local user interaction to trigger recursive deletion. Gopass is not shipped or supported in Red Hat Enterprise Linux, restricting exposure primarily to Fedora and EPEL environments. The blast radius is constrained to the filesystem permissions of the executing user without granting code execution or elevated privileges.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.17.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "gopass", "source": "cna", "vendor": "gopasspw"}, "product": "gopass", "vendor": "gopasspw"}], "created": "2026-10-28T23:00:18.814462+00:00", "updated": "2026-10-29T12:29:53.556504+00:00", "vendors": ["gopasspw", "gopasspw$PRODUCT$gopass"]}