Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2025-53633: Chall-Manager can unpack zip bombs without limits
CVE-2025-53633 · published 1 year ago
Summary
Chall-Manager (ctfer-io/chall-manager) extracts zip files without checking how large the unpacked data will become. An attacker can upload a specially crafted zip that expands to consume excessive disk space or CPU, potentially disrupting the service, and no login is required to do this. Apply the update that ships in version 0.1.4 to add size checks and stop the issue.
What to do
- Update github.com ctfer-io to version 0.1.4.
- Update ctfer-io chall-manager to version 0.1.4 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | ctfer-io |
< 0.1.4 Fix: upgrade to 0.1.4
|
| – | ctfer-io | chall-manager |
< 0.1.4 cpe:2.3:a:ctfer-io:chall-manager:*:*:*:*:*:*:*:* |
Original advisory text
Chall-Manager's scenario decoding process does not check for zip bombs
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 14042aa and shipped in v0.1.4.
References
- https://github.com/advisories/GHSA-r7fm-3pqm-ww5w
- https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4 URL
- https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-r7fm-3pqm-ww5... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-53633 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53633... Vendor Advisory
- https://github.com/ctfer-io/chall-manager/commit/14042aa66a577caee777e10fe09adcf... Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-405Asymmetric Resource Consumption (Amplification)
CWE-409Improper Handling of Highly Compressed Data (Data Amplification)
Timeline
Published10 Jul 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta