github - ghsa-3gv2-v3jx-r9fh

ghsa-3gv2-v3jx-r9fh

Vulnerability from github

Published

2025-07-10 17:48

Modified

2025-08-14 22:21

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
8.8 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive

Details

Impact

When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system.

Patches

Patch has been implemented by commit 47d188f and shipped in v0.1.4.

Workarounds

No workaround exist.

References

N/A.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/ctfer-io/chall-manager"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-53632"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-10T17:48:54Z",
    "nvd_published_at": "2025-07-10T20:15:27Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nWhen decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips.\nExploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is **highly** recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system.\n\n### Patches\nPatch has been implemented by [commit `47d188f`](https://github.com/ctfer-io/chall-manager/commit/47d188fda5e3f86285e820f12ad9fb6f9930662c) and shipped in [`v0.1.4`](https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4).\n\n### Workarounds\nNo workaround exist.\n\n### References\nN/A.",
  "id": "GHSA-3gv2-v3jx-r9fh",
  "modified": "2025-08-14T22:21:05Z",
  "published": "2025-07-10T17:48:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-3gv2-v3jx-r9fh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53632"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ctfer-io/chall-manager/commit/47d188fda5e3f86285e820f12ad9fb6f9930662c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ctfer-io/chall-manager"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive"
}

CVE-2025-53632 (GCVE-0-2025-53632)

Vulnerability from cvelistv5

Published

2025-07-10 19:36

Modified

2025-07-10 20:31

Severity ?

8.8 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 47d188f and shipped in v0.1.4.

References

►

URL

Tags

	https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-3gv2-v3jx-r9fh	x_refsource_CONFIRM
	https://github.com/ctfer-io/chall-manager/commit/47d188fda5e3f86285e820f12ad9fb6f9930662c	x_refsource_MISC
	https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	ctfer-io	chall-manager	Version: < 0.1.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53632",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-10T20:31:38.651737Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-10T20:31:48.462Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "chall-manager",
          "vendor": "ctfer-io",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.1.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 47d188f and shipped in v0.1.4."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-10T19:36:47.463Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-3gv2-v3jx-r9fh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-3gv2-v3jx-r9fh"
        },
        {
          "name": "https://github.com/ctfer-io/chall-manager/commit/47d188fda5e3f86285e820f12ad9fb6f9930662c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ctfer-io/chall-manager/commit/47d188fda5e3f86285e820f12ad9fb6f9930662c"
        },
        {
          "name": "https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4"
        }
      ],
      "source": {
        "advisory": "GHSA-3gv2-v3jx-r9fh",
        "discovery": "UNKNOWN"
      },
      "title": "Chall-Manager\u0027s scenario decoding process does not check for zip slips"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-53632",
    "datePublished": "2025-07-10T19:36:47.463Z",
    "dateReserved": "2025-07-07T14:20:38.389Z",
    "dateUpdated": "2025-07-10T20:31:48.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-3gv2-v3jx-r9fh

Vulnerability from github

Impact

Patches

Workarounds

References

CVE-2025-53632 (GCVE-0-2025-53632)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature