What is the CVSS score of CVE-2025-53632?

CVE-2025-53632 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Docker are affected by CVE-2025-53632?

A critical vulnerability in Chall-Manager allows unauthenticated attackers to write files to arbitrary locations on the system through malicious zip archives, potentially enabling complete system…. A patch is available.

How to fix or mitigate CVE-2025-53632?

Within 24 hours: Verify Chall-Manager version and confirm current deployment is v0.1.3 or earlier; if affected, immediately restrict network access to this system to only authorized administrators. Within 7 days: Deploy patch to v0.1.4 (commit 47d188f) after testing in a non-production environment. Within 30 days: Conduct a review of file system permissions and implement principle of least privilege on the Chall-Manager service account to limit impact of any exploitation attempts.

Docker CVE-2025-53632

EUVD-2025-21069 CRITICAL

Path Traversal (CWE-22)

2025-07-10 security-advisories@github.com

GHSA-3gv2-v3jx-r9fh

Path Traversal Docker Chall Manager Suse

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SUSE

8.8 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21069

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

Patch released

Mar 16, 2026 - 06:52 nvd

Patch available

CVE Published

Jul 10, 2025 - 20:15 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 47d188f and shipped in v0.1.4.

AnalysisAI

CVE-2025-53632 is a path traversal vulnerability (zip slip) in Chall-Manager v0.1.3 and earlier that allows unauthenticated attackers to write arbitrary files to the system when processing scenario zip archives. The vulnerability has a CVSS 9.1 severity score due to high integrity and availability impact, though real-world exploitation risk is partially mitigated by deployment recommendations to isolate Chall-Manager within internal infrastructure. A patch is available in v0.1.4 via commit 47d188f.

Technical ContextAI

Chall-Manager is a platform-agnostic challenge orchestration system that processes compressed scenario files (zip archives) to initialize gaming environments. The vulnerability stems from improper input validation during zip file extraction—specifically, the application fails to sanitize file paths extracted from zip entries against directory traversal sequences (e.g., '../../../etc/passwd'). This is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The flaw allows attackers to write files outside the intended extraction directory by crafting malicious zip archives containing path traversal sequences in file names. No authentication or authorization checks are enforced before scenario decoding, making this a completely unauthenticated attack surface.

RemediationAI

Immediate remediation: Upgrade Chall-Manager to v0.1.4 or later, which includes the security fix from commit 47d188f. For organizations unable to immediately patch: (1) Restrict network access to Chall-Manager to trusted internal networks only—do not expose on untrusted networks or the internet; (2) Disable or restrict the scenario upload/decoding functionality if not actively in use; (3) Monitor file system activity for unexpected writes outside configured scenario extraction directories; (4) Run Chall-Manager with minimal file system permissions (principle of least privilege—restrict write access to only necessary directories). Post-patch validation: Verify v0.1.4 installation and test zip extraction with benign and adversarial zip archives containing path traversal sequences (e.g., '../test.txt') to confirm the traversal is prevented.