What’s Vulnerable › Vulnerabilities

CVE-2026-32805: Romeo is vulnerable to Archive Slip due to missing checks in sanitization

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-18 · updated 2026-06-17
• Weakness: CWE-22

Description

Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the `sanitizeArchivePath` function in `webserver/api/v1/decoder.go` (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the `strings.HasPrefix` check. A crafted tar archive can write files outside the intended destination directory. Version 0.2.2 fixes the issue.

Affected products

• ctfer-io romeo: before 0.2.2 — fixed in 0.2.2

How to fix

Upgrade to a fixed version: ctfer-io romeo 0.2.2. Check the vendor advisory for mitigations.

References

• https://github.com/ctfer-io/romeo/commit/c2ebcfb9f305fd5f6ef68858de82507dbac10263
• https://github.com/ctfer-io/romeo/security/advisories/GHSA-p799-g7vv-f279
• https://github.com/ctfer-io/romeo/security/advisories/GHSA-p799-g7vv-f279

Get alerted when CVE-2026-32805 or the next vulnerability affects your stack