EUVD-2026-112500

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

CVE-2026-118756

The gopass password manager (versions before 1.17.0 ) contains a path traversal vulnerability in its filesystem storage backend. The flaw is triggered via ../ entry names within the Prune and IsDir functions. A collaborator with write access to a shared git-synced store can introduce crafted entr...

CVE-2026-71493: Improper Limitation of a Pathname to a Restricted Directory

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an...