https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 07:52:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276549 EUVD-2026-276549 https://cve.radiocsirt.org/vuln/euvd-2026-276549 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32805 <p>Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the `sanitizeArchivePath` function in `webserver/api/v1/decoder.go` (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the `strings.HasPrefix` check. A crafted tar archive can write files outside the intended destination directory. Version 0.2.2 fixes the issue.</p> <p>Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the `sanitizeArchivePath` function in `webserver/api/v1/decoder.go` (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the `strings.HasPrefix` check. A crafted tar archive can write files outside the intended destination directory. Version 0.2.2 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32805 https://cve.radiocsirt.org/vuln/ghsa-p799-g7vv-f279 <p><strong>Affected:</strong> Go: github.com/ctfer-io/romeo/webserver</p> <p>## Summary</p> <p>The `sanitizeArchivePath` function in `webserver/api/v1/decoder.go` (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the `strings.HasPrefix` check. A crafted tar archive can write files outside the intended destination directory.</p> <p>## Vulnerable Code</p> <p>File: `webserver/api/v1/decoder.go`, lines 80-88</p> <p>```go func sanitizeArchivePath(d, t string) (v string, err error) { v = filepath.Join(d, t) if strings.HasPrefix(v, filepath.Clean(d)) { return v, nil } return &#34;&#34;, &amp;ErrPathTainted{ Path: t, } } ```</p> <p>The function is called at line 48 inside `[*Decompressor].Unzip`, which is invoked by `Decode` (line 80) during execution of the webserver CLI (command `download`).</p> <p>## Root Cause</p> <p>`strings.HasPrefix(v, filepath.Clean(d))` does not append a trailing `/` to the directory prefix, causing a **directory name prefix collision**. If the destination is `/home/user/extract-output` and a tar entry is named `../extract-outputevil/pwned`, the joined path `/home/user/extract-outputevil/pwned` passes the prefix check — it starts with `/home/user/extract-output` — even though it is entirely outside the intended directory.</p> <p>## Steps to Reproduce</p> <p>1. **Deploy Romeo**. A measured app writes its coverage data.</p> <p>2. **Place the PoC zip on the PVC.** Any pod with write access to the `ReadWriteMany` PVC (or the webserver itself) copies a `poc-path-traversal.tar` into the `coverdir` mount path. The archive contains legitimate coverage fi…</p> <p><strong>Affected:</strong> Go: github.com/ctfer-io/romeo/webserver</p> <p>## Summary</p> <p>The `sanitizeArchivePath` function in `webserver/api/v1/decoder.go` (lines 80-88) is vulnerable to a path traversal bypass due to a missing trailing path separator in the `strings.HasPrefix` check. A crafted tar archive can write files outside the intended destination directory.</p> <p>## Vulnerable Code</p> <p>File: `webserver/api/v1/decoder.go`, lines 80-88</p> <p>```go func sanitizeArchivePath(d, t string) (v string, err error) { v = filepath.Join(d, t) if strings.HasPrefix(v, filepath.Clean(d)) { return v, nil } return &#34;&#34;, &amp;ErrPathTainted{ Path: t, } } ```</p> <p>The function is called at line 48 inside `[*Decompressor].Unzip`, which is invoked by `Decode` (line 80) during execution of the webserver CLI (command `download`).</p> <p>## Root Cause</p> <p>`strings.HasPrefix(v, filepath.Clean(d))` does not append a trailing `/` to the directory prefix, causing a **directory name prefix collision**. If the destination is `/home/user/extract-output` and a tar entry is named `../extract-outputevil/pwned`, the joined path `/home/user/extract-outputevil/pwned` passes the prefix check — it starts with `/home/user/extract-output` — even though it is entirely outside the intended directory.</p> <p>## Steps to Reproduce</p> <p>1. **Deploy Romeo**. A measured app writes its coverage data.</p> <p>2. **Place the PoC zip on the PVC.** Any pod with write access to the `ReadWriteMany` PVC (or the webserver itself) copies a `poc-path-traversal.tar` into the `coverdir` mount path. The archive contains legitimate coverage fi…</p> https://cve.radiocsirt.org/vuln/ghsa-p799-g7vv-f279