gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…gopass/security/advisories/GHSA-rw43-4vhf-hcvj Üretici bülteni
• github.com/…ommit/4f76ed537d8293ab88959a31a932dd9b3112a0a2 Yama
• vulncheck.com/…-path-traversal-via-fs-storage-prune-and-isdir Üçüncü taraf
• github.com/gopasspw/gopass/releases/tag/v1.17.0 Diğer
• github.com/…b/v1.16.1/internal/backend/storage/fs/store.go Diğer

Kayıt geçmişi

1. 29 Eki 2026 00:11Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-118667LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
• 5,9 CVE-2026-118654Echo static file middleware route protection bypass via encoded dot-dot traversal
• 9,4 CVE-2026-63190FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
• 4,4 CVE-2026-118680SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias
• 8,8 CVE-2026-118619Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability
• 8,8 CVE-2026-103407Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management