CVE-2026-118756

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

EUVD-2026-112500

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

Linux Distros Unpatched Vulnerability : CVE-2026-118756

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password...

UBUNTU-CVE-2026-118756

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

CVE-2026-118756

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

CVE-2026-118756

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

DEBIAN-CVE-2026-118756

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

CVE-2026-118756

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

CVE-2026-118756 gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

CVE-2026-118756 gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

CVE-2026-118756

The gopass password manager (versions before 1.17.0 ) contains a path traversal vulnerability in its filesystem storage backend. The flaw is triggered via ../ entry names within the Prune and IsDir functions. A collaborator with write access to a shared git-synced store can introduce crafted entr...

PT-2026-129202

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

CVE-2026-118756: gopasspw gopass: gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to…

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

CVE-2026-105945 Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage

The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and...

com.datastax.oss:kafka-0-10 (4.0.3.8), com.datastax.oss:kafka-0-9 (4.0.3.8) +15 more potentially affected by CVE-2026-105945 via org.apache.pulsar:pulsar-package-filesystem-storage (>=4.0.0, <=4.0.13)

org.apache.pulsar:pulsar-package-filesystem-storage MAVEN version =4.0.0, =8.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.13 and more Source cves: CVE-2026-105945 Source advisory: MEND:CVE-2026-105945...

org.apache.pulsar:pulsar-broker (>=4.2.0, <=4.2.4), org.apache.pulsar:pulsar-broker-auth-athenz (>=4.2.0, <=4.2.4) +3 more potentially affected by CVE-2026-105945 via org.apache.pulsar:pulsar-package-filesystem-storage (>=4.2.0, <=4.2.4)

org.apache.pulsar:pulsar-package-filesystem-storage MAVEN version =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.4 Source cves: CVE-2026-105945 Source advisory: MEND:CVE-2026-105945...

EUVD-2026-69293

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

CVE-2026-84232: Improper Neutralization of Input During Web Page Generation

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

go-git: Malicious reference names may modify files outside the reference storage

Impact A path traversal issue in go-git could allow malicious reference names to access files outside the repository's intended reference storage. Loose references are stored under .git/. The reference name was previously used as a path without verifying that the resolved path remained within the...