Gopass
Monthly
Path traversal in gopass's filesystem storage backend lets a write-capable collaborator on a shared, git-synced password store plant a crafted entry name containing ../ sequences; when a victim runs gopass rm -r on that entry, Prune calls os.RemoveAll on a path outside the store root and can delete arbitrary directory trees the victim can write to. The issue affects gopass before 1.17.0 and is fixed in 1.17.0. Exploitation requires the victim to run recursive delete against the crafted entry, so it is local, interactive, and bounded by filesystem permissions; no confirmed public exploit code is identified, and the advisory states a PoC is available upon request.
Path traversal in gopass's filesystem storage backend lets a write-capable collaborator on a shared, git-synced password store plant a crafted entry name containing ../ sequences; when a victim runs gopass rm -r on that entry, Prune calls os.RemoveAll on a path outside the store root and can delete arbitrary directory trees the victim can write to. The issue affects gopass before 1.17.0 and is fixed in 1.17.0. Exploitation requires the victim to run recursive delete against the crafted entry, so it is local, interactive, and bounded by filesystem permissions; no confirmed public exploit code is identified, and the advisory states a PoC is available upon request.