Threats affecting pkg:golang/gopass

CVE-2026-118756 is a path traversal vulnerability in gopass versions before 1.17.0. It affects the filesystem storage backend, allowing attackers with write access to a shared git-synced password store to craft entries that cause recursive deletion of arbitrary directories outside the intended password store. This occurs via '../' entry names in the Prune and IsDir functions. The vulnerability is fixed in version 1.17.0.