PT-2025-17346 · Z80Pack · Z80Pack

Jackhac + 1 · Published 2025-04-18 · Updated 2025-04-22 · CVE-2025-32953

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions z80pack versions 1.38 and prior

Description The issue concerns the exposure of sensitive information, specifically the GITHUB TOKEN, in the workflow run artifact. This occurs because the makefile-ubuntu.yml workflow file uses actions/upload-artifact@v4 to upload the z80pack-ubuntu artifact, which is a zip of the current directory and includes the automatically generated .git/config file containing the run's GITHUB TOKEN. An attacker can extract the token from the artifact and use it with the Github API to push malicious code or rewrite release commits in the repository.

Recommendations For versions 1.38 and prior, update to a version that includes the fix committed in bd95916 to prevent the exposure of the GITHUB TOKEN. As a temporary workaround, consider restricting access to the makefile-ubuntu.yml workflow file until the issue is resolved. Avoid using the actions/upload-artifact@v4 action in the makefile-ubuntu.yml workflow file until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-32953

GHSA-GPJJ-F76M-9X3Q

Affected Products

Z80Pack

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32953.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-32953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32953 · Security Note
• https://github.com/udo-munk/z80pack/commit/bd9591615ae7b1e6229aa60a485447441c4a0c15 · Note
• https://github.com/udo-munk/z80pack/commit/95535987d690bd20849fbf143f267283f0e2db91 · Note
• https://github.com/udo-munk/z80pack/commit/836c2e37b54f86bb4bed9e1406b67e52aa52308d · Note
• https://github.com/udo-munk/z80pack/security/advisories/GHSA-gpjj-f76m-9x3q · Note
• https://github.com/udo-munk/z80pack/commit/1e06c2fe498ca772002b5c4f6f9e3085061e47da · Note
• https://github.com/udo-munk/z80pack · Note
• https://twitter.com/CVEnew/status/1913455456007127141 · Twitter Post
• https://t.me/latest_high_impact_cve/2162 · Telegram Post
• https://t.me/cvedetector/23352 · Telegram Post
• https://twitter.com/CveFindCom/status/1914584263065809030 · Twitter Post
• https://t.me/cvetracker/21963 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1913355735708090431 · Twitter Post