N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53632

CVE-2025-53632: Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive

Impact

When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system.

Patches

Patch has been implemented by commit 47d188f and shipped in v0.1.4.

Workarounds

No workaround exist.

References

N/A.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53632

CVE-2025-53632:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ctfer-io/chall-manager	go	< 0.1.4	0.1.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic 'Zip Slip' path traversal issue located in the pkg/scenario/io.go file of the ctfer-io/chall-manager repository. The root cause lies within the Decode function, which is responsible for processing and extracting zip archives representing scenarios.

The Decode function iterates through each file within the provided zip archive. For each file, it constructs a destination path using filepath.Join, combining a base directory (cd) with the filename read directly from the zip entry (f.Name). The critical flaw is the lack of validation or sanitization of f.Name. An attacker can create a zip archive containing entries with malicious filenames, such as ../../../../etc/passwd, which filepath.Join will resolve to a path outside of the intended extraction directory.

This malicious path is then passed to the copy function (which was renamed to copyTo in the patched version). The copy function proceeds to open and write the contents of the zip entry to this path. This allows an attacker to overwrite arbitrary files on the filesystem with the permissions of the user running the Chall-Manager application.

The patch addresses this vulnerability by introducing a new function, sanitizeArchivePath. This function is now called within Decode immediately after constructing the file path. It verifies that the resolved path still has the intended base directory as a prefix, effectively preventing the path from 'escaping' the target directory. If the path is determined to be malicious, an error is returned, and the extraction is halted. The identification of Decode and the original copy function as vulnerable is based directly on the removal of the unsafe filepath.Join call and the introduction of the sanitization step in the provided patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.