CVE-2026-32805
Romeo is vulnerable to Archive Slip due to missing checks in sanitization
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the `sanitizeArchivePath` function in `webserver/api/v1/decoder.go` (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the `strings.HasPrefix` check. A crafted tar archive can write files outside the intended destination directory. Version 0.2.2 fixes the issue.
| CWE | CWE-22 |
| Vendor | ctfer-io |
| Product | romeo |
| Published | Mar 18, 2026 |
| Last Updated | Mar 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for ctfer-io romeo
Be the first to know when new unknown vulnerabilities affecting ctfer-io romeo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
ctfer-io / romeo
< 0.2.2