CVE-2026-78145
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in CTFd up to 3.8.4 in the _is_safe_url function of the CTFd/utils/validators/__init__.py file. Manipulation of the Next argument leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch name is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.
Risk Assessment
A remote attacker can exploit open redirect for phishing or redirecting users to malicious sites, potentially leading to credential theft.
Recommendation
It is recommended to update CTFd to a version containing the patch (commit 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9) or later. Also review and restrict allowed URLs in the _is_safe_url function.
Other vulnerabilities in CTFd
See all- CVE-2025-29419Low risk· EPSS 4%
CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack.
- CVE-2024-46242High
In CTFd 3.7.3, the validate_email function in CTFd/utils/validators/__init__.py is vulnerable to a Regular expression Denial of Service (ReDoS) attack. An attacker can supply a crafted email address during registration, causing excessive server load.
Original NVD description (English source)
A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.