Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 47d188f and shipped in v0.1.4.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Ctfer-io
  • Chall-manager

Configuration 1 [-]

cpe:2.3:a:ctfer-io:chall-manager:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/ctfer-io/chall-manager/commit/47d188fda5e3f86285e820f12ad9fb6f9930662c cve-icon cve-icon
https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4 cve-icon cve-icon
https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-3gv2-v3jx-r9fh cve-icon cve-icon
History

Thu, 14 Aug 2025 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Ctfer-io
Ctfer-io chall-manager
CPEs cpe:2.3:a:ctfer-io:chall-manager:*:*:*:*:*:*:*:*
Vendors & Products Ctfer-io
Ctfer-io chall-manager
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00129}

 epss

{'score': 0.00153}

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00129}

Thu, 10 Jul 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Jul 2025 19:45:00 +0000

Type Values Removed Values Added
Description Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 47d188f and shipped in v0.1.4.
Title Chall-Manager's scenario decoding process does not check for zip slips
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2025-07-10T19:36:47.463Z

Updated: 2025-07-10T20:31:48.462Z

Reserved: 2025-07-07T14:20:38.389Z

Link: CVE-2025-53632

cve-icon Vulnrichment

Updated: 2025-07-10T20:31:42.976Z

cve-icon NVD

Status : Analyzed

Published: 2025-07-10T20:15:27.673

Modified: 2025-08-14T20:49:48.747

Link: CVE-2025-53632

cve-icon Redhat

No data.