Romeo contains a flaw in the sanitizeArchivePath routine that omits a trailing path separator check. When a specially crafted tarball is uploaded through the API, the extraction process can bypass the intended destination guard, allowing files to be written outside of the intended directory. This defect enables an attacker to modify or overwrite arbitrary files within the deployed instance, potentially compromising data integrity and confidentiality.

The vulnerability affects the ctfer-io:romeo application in all versions released before 0.2.2. Deployments that accept tarfile uploads via the web API, such as those used for measuring Go coverage in GitHub Actions, are exposed. Users running Romeo 0.2.1 or earlier are at risk.

The CVSS base score of 8.3 indicates a high severity risk for path traversal. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. The likely attack vector is a crafted tar upload to the API endpoint; successful exploitation would result in file writes beyond the intended extraction directory, potentially altering or replacing existing files.