Vulnerability · Published Mar 18, 2026 · Assigned by GitHub_M

CVE-2026-32805Romeo is vulnerable to Archive Slip due to missing checks in sanitization

High 8.3

In plain English

A high-severity path traversal in romeo from ctfer-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.3High

Exploit odds (30 days)0.5%top 59.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the `sanitizeArchivePath` function in `webserver/api/v1/decoder.go` (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the `strings.HasPrefix` check. A crafted tar archive can write files outside the intended destination directory. Version 0.2.2 fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/ctfer-io/romeo/webserver	0.2.2	GHSA-p799-g7vv-f279
Go	github.com/ctfer-io/romeo/webserver	0.2.2	GO-2026-4719

Affected products (as reported)

Vendor	Product	Versions
ctfer-io	romeo	< 0.2.2

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L

References

https://github.com/ctfer-io/romeo/security/advisories/GHSA-p799-g7vv-f279 x_refsource_CONFIRM
https://github.com/ctfer-io/romeo/commit/c2ebcfb9f305fd5f6ef68858de82507dbac10263 x_refsource_MISC