Description
A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.
Published: 2026-08-23
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Open Redirect
Action: Patch
AI Analysis

Impact

The CTFd web framework contains a flaw in the _is_safe_url function defined in CTFd/utils/validators/__init__.py. The function fails to properly validate the Next argument, allowing an attacker to supply a crafted URL that causes the application to redirect users to an arbitrary address. This open redirect is the primary impact identified as CWE‑601.

Affected Systems

Vulnerable versions of CTFd include all releases up to and including 3.8.4. The patch is available in the commit referenced by the identifier 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9, which should be applied in version 3.8.5 or later. The affected product is the CTFd application framework, typically used for hosting Capture‑The‑Flag challenges.

Risk and Exploitability

With a CVSS score of 5.3 the vulnerability is moderate. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. The attack can be launched remotely by an end‑user who controls the Next parameter, making exploitation straightforward for anyone with internet access. The vulnerability presents an open redirect but does not directly alter the application state.

Generated by OpenCVE AI on August 24, 2026 at 00:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade CTFd to version 3.8.5 or later, which contains the fix for the open redirect in _is_safe_url.
  • If upgrading immediately is infeasible, modify the application’s request handling to strip or validate the Next query parameter before redirecting.
  • As a temporary measure, restrict the application’s redirect domain list to trusted domains only, ensuring that any redirect leads only to known safe URLs.

Generated by OpenCVE AI on August 24, 2026 at 00:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 23 Aug 2026 23:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.
Title CTFd __init__.py _is_safe_url redirect
First Time appeared Ctfd
Ctfd ctfd
Weaknesses CWE-601
CPEs cpe:2.3:a:ctfd:ctfd:*:*:*:*:*:*:*:*
Vendors & Products Ctfd
Ctfd ctfd
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Ctfd Ctfd
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-24T18:12:57.182Z

Reserved: 2026-08-23T06:27:57.055Z

Link: CVE-2026-78145

cve-icon Vulnrichment

Updated: 2026-08-24T18:12:50.495Z

cve-icon NVD

Status : Deferred

Published: 2026-08-23T23:16:46.043

Modified: 2026-08-24T18:17:24.323

Link: CVE-2026-78145

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T01:00:03Z

Weaknesses
  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')