TI-2026-25275 Aliases CVE-2026-32805 GHSA-p799-g7vv-f279

Romeo is vulnerable to Archive Slip due to missing checks in sanitization

HIGH 77CWE-22Published 2026-03-18 · Updated 2026-03-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the `sanitizeArchivePath` function in `webserver/api/v1/decoder.go` (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the `strings.HasPrefix` check. A crafted tar archive can write files outside the intended destination directory. Version 0.2.2 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00461 40th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed romeo (ctfer-io): 0.2.2github.com/ctfer-io/romeo/webserver (Go): 0.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ctfer-io	romeo	before 0.2.2	0.2.2	Patch available	CNA
—	github.com/ctfer-io/romeo/webserver (Go)	before 0.2.2	0.2.2	Patch available	GHSA-p799-g7vv-f279

romeo Vendorctfer-io Affected before 0.2.2 Fixed in 0.2.2 Patch available CNA
github.com/ctfer-io/romeo/webserver (Go) Vendor— Affected before 0.2.2 Fixed in 0.2.2 Patch available GHSA-p799-g7vv-f279

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ctfer-io:romeo::::::::	before 0.2.2	Vulnerable	ctfer-io

cpe:2.3:a:ctfer-io:romeo:*:*:*:*:*:*:*:* Versions before 0.2.2 Vulnerable ·ctfer-io

Remediation

Fix · CNA romeo (ctfer-io) Fixed in 0.2.2
Fix · GHSA-p799-g7vv-f279 github.com/ctfer-io/romeo/webserver (Go) Fixed in 0.2.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-32805
2026-10-03 Alias added: GHSA-p799-g7vv-f279

References

TI-2026-25229 Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace CVSS 4.0HIGH 7.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences