CVE-2026-78145CWE-601

CVE-2026-78145

Medium · published August 24, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
45.7
In the wild
Unconfirmed
What it is

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00557 · 45.7th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-08-24T03:16Z
References (9)
https://github.com/CTFd/CTFd/ · [email protected]https://github.com/CTFd/CTFd/commit/5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9 · [email protected]https://github.com/CTFd/CTFd/pull/3026 · [email protected]https://github.com/CTFd/CTFd/releases/tag/3.8.4 · [email protected]https://mblunt.dev/writeups/ctfd-open-redirect/ · [email protected]https://vuldb.com/cve/CVE-2026-78145 · [email protected]https://vuldb.com/submit/882469 · [email protected]https://vuldb.com/vuln/394533 · [email protected]https://vuldb.com/vuln/394533/cti · [email protected]
EPSS history
Timeline
  • 23 AUG 22:45Z
    CTFd __init__.py _is_safe_url redirect
    cvelistv5