CVE-2026-32805

Katalog CVE

CVSS 7.5 · High EPSS 0,59%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada ctfer-io romeo. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the `sanitizeArchivePath` function in `webserver/api/v1/decoder.go` (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the `strings.HasPrefix` check. A crafted tar archive can write files outside the intended destination directory. Version 0.2.2 fixes the issue.

Rincian

Terbit di NVD

18 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ctfer-io/romeo/security/advisories/GHSA-p799-g7vv-f279 exploit · advisory vendor
• https://github.com/ctfer-io/romeo/commit/c2ebcfb9f305fd5f6ef68858de82507dbac10263 patch