EUVD-2025-21069
GHSA-3gv2-v3jx-r9fh
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
4Description
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 47d188f and shipped in v0.1.4.
Analysis
CVE-2025-53632 is a path traversal vulnerability (zip slip) in Chall-Manager v0.1.3 and earlier that allows unauthenticated attackers to write arbitrary files to the system when processing scenario zip archives. The vulnerability has a CVSS 9.1 severity score due to high integrity and availability impact, though real-world exploitation risk is partially mitigated by deployment recommendations to isolate Chall-Manager within internal infrastructure. A patch is available in v0.1.4 via commit 47d188f.
Technical Context
Chall-Manager is a platform-agnostic challenge orchestration system that processes compressed scenario files (zip archives) to initialize gaming environments. The vulnerability stems from improper input validation during zip file extraction—specifically, the application fails to sanitize file paths extracted from zip entries against directory traversal sequences (e.g., '../../../etc/passwd'). This is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The flaw allows attackers to write files outside the intended extraction directory by crafting malicious zip archives containing path traversal sequences in file names. No authentication or authorization checks are enforced before scenario decoding, making this a completely unauthenticated attack surface.
Affected Products
Chall-Manager versions prior to v0.1.4, specifically v0.1.3 and earlier. The vendor commit 47d188f containing the fix was shipped in release v0.1.4. No specific CPE string data was provided in the source material; affected product scope is: Product: Chall-Manager, Affected Versions: <0.1.4, Fixed Version: >=0.1.4. The vulnerability affects all installations of these versions regardless of platform (system is described as 'platform-agnostic').
Remediation
Immediate remediation: Upgrade Chall-Manager to v0.1.4 or later, which includes the security fix from commit 47d188f. For organizations unable to immediately patch: (1) Restrict network access to Chall-Manager to trusted internal networks only—do not expose on untrusted networks or the internet; (2) Disable or restrict the scenario upload/decoding functionality if not actively in use; (3) Monitor file system activity for unexpected writes outside configured scenario extraction directories; (4) Run Chall-Manager with minimal file system permissions (principle of least privilege—restrict write access to only necessary directories). Post-patch validation: Verify v0.1.4 installation and test zip extraction with benign and adversarial zip archives containing path traversal sequences (e.g., '../test.txt') to confirm the traversal is prevented.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today