Threats tagged 'ghsa-g69m-c6cf-wpcv'

gopass versions prior to 1.17.0 have a path traversal vulnerability in the filesystem storage backend. This flaw allows attackers with write access to a shared git-synced password store to craft entries with '../' sequences. When a victim runs a recursive removal command (gopass rm -r), these crafted entries can cause deletion of directories outside the intended password store location.