GHSA-P799-G7VV-F279
Vulnerability from github – Published: 2026-03-16 20:47 – Updated: 2026-03-16 21:55Summary
The sanitizeArchivePath function in webserver/api/v1/decoder.go (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the strings.HasPrefix check. A crafted tar archive can write files outside the intended destination directory.
Vulnerable Code
File: webserver/api/v1/decoder.go, lines 80-88
func sanitizeArchivePath(d, t string) (v string, err error) {
v = filepath.Join(d, t)
if strings.HasPrefix(v, filepath.Clean(d)) {
return v, nil
}
return "", &ErrPathTainted{
Path: t,
}
}
The function is called at line 48 inside [*Decompressor].Unzip, which is invoked by Decode (line 80) during execution of the webserver CLI (command download).
Root Cause
strings.HasPrefix(v, filepath.Clean(d)) does not append a trailing / to the directory prefix, causing a directory name prefix collision. If the destination is /home/user/extract-output and a tar entry is named ../extract-outputevil/pwned, the joined path /home/user/extract-outputevil/pwned passes the prefix check — it starts with /home/user/extract-output — even though it is entirely outside the intended directory.
Steps to Reproduce
-
Deploy Romeo. A measured app writes its coverage data.
-
Place the PoC zip on the PVC. Any pod with write access to the
ReadWriteManyPVC (or the webserver itself) copies apoc-path-traversal.tarinto thecoverdirmount path. The archive contains legitimate coverage files alongside two crafted entries with path-traversal names. -
Run the webserver CLI against the running webserver:
webserver download \ --server http://localhost:8080 \ --directory /home/user/extract-output -
Observe the bypass.
unzipprocesses the zip stream. For the malicious entries: ``` // entry name: ../extract-outputevil/poc-proof.txt filepath.Join("/home/user/extract-output", "../extract-outputevil/poc-proof.txt") => "/home/user/extract-outputevil/poc-proof.txt"
strings.HasPrefix("/home/user/extract-outputevil/poc-proof.txt",
"/home/user/extract-output")
=> true // BUG: prefix collision; file lands OUTSIDE target dir
``
Both malicious entries are written outside/home/user/extract-output/`. The legitimate coverage files land correctly inside it.
Impact
Successful exploitation gives an attacker arbitrary file write on the machine running the webserver CLI. Real-world primitives include:
- Overwriting
~/.bashrc/~/.zshrc/~/.profilefor RCE on next shell login - Appending to
~/.ssh/authorized_keysfor persistent SSH backdoor - Dropping a malicious entry into
~/.kube/configto hijack cluster access - Writing crontab entries for persistent scheduled execution
The attack surface is widened by the default ReadWriteMany PVC access mode, which means any pod in the cluster with the PVC mounted can inject the payload — not just the Romeo webserver itself.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/ctfer-io/romeo/webserver"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32805"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-16T20:47:02Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nThe `sanitizeArchivePath` function in `webserver/api/v1/decoder.go` (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the `strings.HasPrefix` check. A crafted tar archive can write files outside the intended destination directory.\n\n## Vulnerable Code\n\nFile: `webserver/api/v1/decoder.go`, lines 80-88\n\n```go\nfunc sanitizeArchivePath(d, t string) (v string, err error) {\n\tv = filepath.Join(d, t)\n\tif strings.HasPrefix(v, filepath.Clean(d)) {\n\t\treturn v, nil\n\t}\n\treturn \"\", \u0026ErrPathTainted{\n\t\tPath: t,\n\t}\n}\n```\n\nThe function is called at line 48 inside `[*Decompressor].Unzip`, which is invoked by `Decode` (line 80) during execution of the webserver CLI (command `download`).\n\n## Root Cause\n\n`strings.HasPrefix(v, filepath.Clean(d))` does not append a trailing `/` to the directory prefix, causing a **directory name prefix collision**. If the destination is `/home/user/extract-output` and a tar entry is named `../extract-outputevil/pwned`, the joined path `/home/user/extract-outputevil/pwned` passes the prefix check \u2014 it starts with `/home/user/extract-output` \u2014 even though it is entirely outside the intended directory.\n\n## Steps to Reproduce\n\n1. **Deploy Romeo**. A measured app writes its coverage data.\n\n2. **Place the PoC zip on the PVC.** Any pod with write access to the `ReadWriteMany` PVC (or the webserver itself) copies a `poc-path-traversal.tar` into the `coverdir` mount path. The archive contains legitimate coverage files alongside two crafted entries with path-traversal names.\n\n3. **Run the webserver CLI against the running webserver:**\n ```\n webserver download \\\n --server http://localhost:8080 \\\n --directory /home/user/extract-output\n ```\n\n4. **Observe the bypass.** `unzip` processes the zip stream. For the malicious entries:\n ```\n // entry name: ../extract-outputevil/poc-proof.txt\n filepath.Join(\"/home/user/extract-output\", \"../extract-outputevil/poc-proof.txt\")\n =\u003e \"/home/user/extract-outputevil/poc-proof.txt\"\n\n strings.HasPrefix(\"/home/user/extract-outputevil/poc-proof.txt\",\n \"/home/user/extract-output\")\n =\u003e true // BUG: prefix collision; file lands OUTSIDE target dir\n ```\n Both malicious entries are written outside `/home/user/extract-output/`. The legitimate coverage files land correctly inside it.\n\n## Impact\n\nSuccessful exploitation gives an attacker arbitrary file write on the machine running the webserver CLI. Real-world primitives include:\n\n- Overwriting `~/.bashrc` / `~/.zshrc` / `~/.profile` for RCE on next shell login\n- Appending to `~/.ssh/authorized_keys` for persistent SSH backdoor\n- Dropping a malicious entry into `~/.kube/config` to hijack cluster access\n- Writing crontab entries for persistent scheduled execution\n\nThe attack surface is widened by the default `ReadWriteMany` PVC access mode, which means any pod in the cluster with the PVC mounted can inject the payload \u2014 not just the Romeo webserver itself.",
"id": "GHSA-p799-g7vv-f279",
"modified": "2026-03-16T21:55:45Z",
"published": "2026-03-16T20:47:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ctfer-io/romeo/security/advisories/GHSA-p799-g7vv-f279"
},
{
"type": "WEB",
"url": "https://github.com/ctfer-io/romeo/commit/c2ebcfb9f305fd5f6ef68858de82507dbac10263"
},
{
"type": "PACKAGE",
"url": "https://github.com/ctfer-io/romeo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L",
"type": "CVSS_V4"
}
],
"summary": " Romeo is vulnerable to Archive Slip due to missing checks in sanitization"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.