CVE-2025-53632
BaseFortify
Publication date: 2025-07-10
Last updated on: 2025-08-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ctfer-io | chall-manager | to 0.1.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Chall-Manager involves improper validation of file paths when decoding a scenario zip archive. Specifically, the system does not check the path of files to be written, which can lead to a zip slip attack. This means an attacker can craft a malicious zip file that writes files outside the intended directory, potentially overwriting critical files. Exploitation requires no authentication or authorization, making it accessible to anyone who can reach the system.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to write arbitrary files anywhere on the system where Chall-Manager runs, potentially leading to system compromise, data corruption, or unauthorized code execution. Since no authentication is required, an attacker could exploit this remotely if they have access to the system, which could result in significant security breaches.
What immediate steps should I take to mitigate this vulnerability?
Apply the patch shipped in Chall-Manager version v0.1.4 which fixes the zip slip vulnerability. Additionally, ensure that Chall-Manager is deployed deep within your infrastructure to limit exposure, as it is recommended to restrict access to the system to prevent exploitation.