CVE-2025-53632 is a Critical severity zip slip (CVSS 9.1) in Chall-Manager, the Challenges on Demand platform from ctfer-io. It does not check the path of files written when it decodes a scenario archive. The fix shipped in v0.1.4, so upgrade to that release or later.
What's affected
The advisory says the problem exists when Chall-Manager decodes a scenario, which is a zip archive, and writes its files. Versions before v0.1.4 are affected, because the patch was implemented in commit 47d188f and shipped in v0.1.4.
The advisory also says that exploitation needs no authentication or authorisation. It adds that the platform should not be reachable by ordinary users, since the maintainers recommend burying it deep within the infrastructure because of its large capabilities. That is advice about network placement, not a reason to skip the upgrade.
The companion issue CVE-2025-53633, a zip bomb in the same decoder, was fixed in the same release.
How to check if you're exposed
Chall-Manager is a Go project, so check the version in your modules, your container image tag or your deployment manifest:
go list -m all | grep ctfer-io/chall-manager
docker images | grep -i chall-manager
If the version is older than v0.1.4, you are exposed. Then answer a second question: who can reach the service? Check firewall rules, ingress definitions and any service that forwards player requests to it. The advisory states that the service should be unreachable by players, so confirm that is true in your deployment.
What to do now
- Upgrade Chall-Manager to v0.1.4 or later and redeploy every instance, including test and staging copies.
- Confirm that the service is on an internal network and that no player facing route can reach its scenario upload function.
- Review the scenarios already stored, and replace any you did not create yourself.
- Run the service with a read only root filesystem and a dedicated writable directory, so a misplaced file cannot land in a sensitive path.
- Subscribe to the repository advisories so future releases reach you quickly.
Why it matters
The weakness is CWE-22, path traversal, in its archive form known as zip slip. Each file inside a zip archive has a name, and that name can include parts that climb out of the target folder. If the extractor joins the name to a base path without checking where the result lands, a crafted archive can write files anywhere the process can write.
The defence is short. Resolve the final path, check that it still sits inside the intended directory, and reject the archive if any entry fails. Chall-Manager did not do this check before v0.1.4.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. The advisory does not describe attacks in the wild. The score is high because the record lists no authentication need, but the maintainers explain that correct network placement lowers the real risk a great deal.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is v0.1.3 safe?
No. The advisory says the patch shipped in v0.1.4, so earlier versions are affected. Upgrade to v0.1.4 or later.
If the service is private, can I skip the upgrade?
You should not. Private placement lowers the chance of reaching the flaw, but a misconfigured route or a compromised neighbour would remove that protection. Upgrading is cheap.
Sources
Last reviewed: 18 October 2026.
