Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/ctfer-io/romeo/webserver

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.3GoPublished

    Romeo is vulnerable to Archive Slip due to missing checks in sanitization

    CVE-2026-32805 · GHSA-p799-g7vv-f279

    Affected
    • Go github.com/ctfer-io/romeo/webserver < 0.2.2
    Fixed in
    0.2.2· Vendor fix available
    Issue
    The sanitizeArchivePath function in webserver/api/v1/decoder.go (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the strings.HasPrefix check. A crafted tar archive can write files outside the intended destination directory. Vulnerable Code File: webserver/api/v1/decoder.go, lines 80-88 The function is called at line 48 inside [Decompressor].Unzip, which is invoked by Decode (line 80) during execution of the webserver CLI (command download). Root Cause strings.HasPrefix(v, filepath.Clean(d)) does not append a trailing / to the directory prefix, causing a directory name prefix collision. If the destination is /home/user/extract-output and a tar entry is named ../extract-outputevil/pwned, the joined path /home/user/extract-outputevil/pwned passes the prefix check — it starts with /home/user/extract-output — even though it is entirely outside the intended directory. Steps to Reproduce 1. Deploy Romeo. A measured app writes its…

    Recommended action: Upgrade to 0.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →