Executive brief
CTFd is a platform for hosting Capture The Flag (CTF) security competitions. An attacker can manipulate the redirect parameter to redirect users to an arbitrary external website, enabling phishing attacks or spreading malware. This occurs because the URL validation function (_is_safe_url) can be bypassed, allowing attackers to serve malicious links to other users.
Technical details
This is an open redirect vulnerability in the _is_safe_url function within CTFd/utils/validators/__init__.py. The vulnerability exists because the URL validation logic fails to properly sanitize the "Next" parameter, allowing an attacker to craft a malicious URL that bypasses the safe-URL check. The attack is remotely exploitable and does not require authentication. An attacker can redirect users to arbitrary external sites, potentially for phishing or credential harvesting. The vulnerability has been patched in commit 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9 and users should upgrade to the patched version.
Affected products
- CTFd CTFd up to 3.8.4
Timeline
- 2026-08-23: disclosed
- 2026-04-20: patched: Patch commit 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9