Summary
Romeo is vulnerable to Archive Slip due to missing checks in sanitization
The sanitizeArchivePath function in webserver/api/v1/decoder.go (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the strings.HasPrefix check. A crafted tar archive can write files outside the intended destination directory.
Vulnerable Code
File: webserver/api/v1/decoder.go, lines 80-88
func sanitizeArchivePath(d, t string) (v string, err error) {
v = filepath.Join(d, t)
if strings.HasPrefix(v, filepath.Clean(d)) {
return v, nil
}
return "", &ErrPathTainted{
Path: t,
}
}
The function is called at line 48 inside [*Decompressor].Unzip, which is invoked by Decode (line 80) during execution of the webserver CLI (command download).
Root Cause
strings.HasPrefix(v, filepath.Clean(d)) does not append a trailing / to the directory prefix, causing a directory name prefix collision. If the destination is /home/user/extract-output and a tar entry is named ../extract-outputevil/pwned, the joined path /home/user/extract-outputevil/pwned passes the prefix check, it starts with /home/user/extract-output, even though it is entirely outside the intended directory.
Steps to Reproduce
Deploy Romeo. A measured app writes its coverage data.
Place the PoC zip on the PVC. Any pod with write access to the
ReadWriteManyPVC (or the webserver itself) copies apoc-path-traversal.tarinto thecoverdirmount path. The archive contains legitimate coverage files alongside two crafted entries with path-traversal names.Run the webserver CLI against the running webserver:
webserver download \ --server http://localhost:8080 \ --directory /home/user/extract-outputObserve the bypass.
unzipprocesses the zip stream. For the malicious entries:// entry name: ../extract-outputevil/poc-proof.txt filepath.Join("/home/user/extract-output", "../extract-outputevil/poc-proof.txt") => "/home/user/extract-outputevil/poc-proof.txt" strings.HasPrefix("/home/user/extract-outputevil/poc-proof.txt", "/home/user/extract-output") => true // BUG: prefix collision; file lands OUTSIDE target dirBoth malicious entries are written outside
/home/user/extract-output/. The legitimate coverage files land correctly inside it.
Impact
Successful exploitation gives an attacker arbitrary file write on the machine running the webserver CLI. Real-world primitives include:
- Overwriting
~/.bashrc/~/.zshrc/~/.profilefor RCE on next shell login - Appending to
~/.ssh/authorized_keysfor persistent SSH backdoor - Dropping a malicious entry into
~/.kube/configto hijack cluster access - Writing crontab entries for persistent scheduled execution
The attack surface is widened by the default ReadWriteMany PVC access mode, which means any pod in the cluster with the PVC mounted can inject the payload, not just the Romeo webserver itself.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-32805? CVE-2026-32805 is a high-severity path traversal vulnerability in github.com/ctfer-io/romeo/webserver (go), affecting versions < 0.2.2. It is fixed in 0.2.2. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- Which versions of github.com/ctfer-io/romeo/webserver are affected by CVE-2026-32805? github.com/ctfer-io/romeo/webserver (go) versions < 0.2.2 is affected.
- Is there a fix for CVE-2026-32805? Yes. CVE-2026-32805 is fixed in 0.2.2. Upgrade to this version or later.
- Is CVE-2026-32805 exploitable, and should I be worried? Whether CVE-2026-32805 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-32805 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-32805? Upgrade
github.com/ctfer-io/romeo/webserverto 0.2.2 or later.