gopass EUVD-2026-112500

Exploitation requires all of the following concrete conditions: (1) gopass is used with a shared, multi-user, git-synced password store (the single-user case has no untrusted entry source); (2) the attacker is a collaborator holding legitimate write access to that shared store; (3) the attacker creates an entry whose name embeds ../ path-traversal sequences, which reaches the victim through a normal git pull / gopass sync; (4) the victim executes the recursive delete command 'gopass rm -r <crafted entry>', whose name flows unvalidated into Store.Prune → os.RemoveAll. Limiting factors that reduce real-world risk: the vulnerable operation is local and needs explicit victim interaction (running recursive delete against the specific crafted entry), the attacker must already be a trusted write-capable store member, and the destructive impact is bounded by the filesystem write permissions of the user running gopass. Affected: gopass versions before 1.17.0 (<= 1.16.1); fixed in 1.17.0, which routes IsDir and Prune through the safePath containment check.

The vendor-assigned CVSS 4.0 score is 6.7 (Medium) with vector AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H, meaning a locally-triggered, low-complexity flaw with no confidentiality or integrity impact but high availability impact (destructive directory deletion). The defining tension is between delivery and trigger: the malicious payload (a crafted ../ entry name) is introduced remotely by a git collaborator and propagates through an ordinary gopass sync, yet the destructive action only fires when the victim locally runs 'gopass rm -r' against that entry - hence AV:L and mandatory user interaction (UI:A), not a remote push-button exploit. No EPSS score is provided in the input and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis' (the GHSA advisory states a PoC exists but only 'available upon request', so no public exploit code is available). The vuln.today decision label is 'this_month', consistent with a patched Medium-severity destructive bug rather than an emergency. One signal to verify: the official vector uses PR:N, but real-world exploitation requires the attacker to be an authenticated collaborator with legitimate write access to the shared store, which is a genuine privilege prerequisite - treat the 'unauthenticated' implication of PR:N with caution. Overall this is a real but conditional priority: destructive and low-complexity once conditions are met, but gated behind multi-user shared-store usage, a malicious insider/collaborator, and a specific victim action. A fixed version (1.17.0) is available, so patching resolves it.

A malicious collaborator with legitimate write access to a shared, git-synced gopass store commits a secret whose name contains ../ path-traversal segments. After the victim syncs the store (git pull / gopass sync) and runs the routine recursive delete 'gopass rm -r' against that entry, gopass's Prune calls os.RemoveAll on the escaped path and destroys an arbitrary directory tree outside the store root, bounded only by the victim's filesystem write permissions. The advisory references a proof-of-concept as available upon request, but no public exploit code is listed; exploitation is local (AV:L) and requires the victim to actively invoke the delete.