EUVD-2026-112500

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

CVE-2026-118756

The gopass password manager (versions before 1.17.0 ) contains a path traversal vulnerability in its filesystem storage backend. The flaw is triggered via ../ entry names within the Prune and IsDir functions. A collaborator with write access to a shared git-synced store can introduce crafted entr...