Path Traversal Vulnerability in Romeo by ctfer-io

CVE-2026-32805

What is CVE-2026-32805?

Romeo, a tool designed to enhance code coverage for Go applications in GitHub Actions, has a vulnerability in the sanitizeArchivePath function prior to version 0.2.2. This flaw allows an attacker to exploit a crafted tar archive, potentially writing files outside of the intended directory due to a path traversal bypass. This issue arises from a missing trailing path separator in the strings.HasPrefix check, exposing systems to unauthorized access to the filesystem. Users are advised to upgrade to version 0.2.2 to mitigate this risk.

References