CTFd 3.8.9
CTFd 3.8.9 has been released with updates to the bundled pip and certifi libraries to remove the compromised eMudhra root certificates.…
CTFd 3.8.8
CTFd 3.8.8 has been released with security fixes for 4 vulnerabilities, including one critical vulnerability.…
CTFd 3.8.7
CTFd 3.8.7 has been released with fixes for the following security vulnerabilities: * Fixed an issue where where the REST API would return the values of Custom Fields despite the field not being set to public * Fixed an issue where max attempts on a challenge could sometimes be bypassed…
CTFd 3.8.6
CTFd 3.8.6 has been released with a security fix for a vulnerability where a malicious admin could disclose internal SMTP credentials.…
CTFd 3.8.2
CTFd 3.8.2 has been released with a security fix for a vulnerability where a malicious admin user could import a crafted zip file to write files arbitrarily depending on the configuration of CTFd.…
CTFd 3.7.6
CTFd 3.7.6 has been released with a security configuration improvement. The TRUSTED_HOSTS config setting has been added to config.ini to restrict CTFd to trusted hostnames. This can help prevent attacks against CTFd when CTFd has been deployed without a reverse proxy (e.g. nginx) or if…
CTFd 3.7.4
CTFd 3.7.4 has been released with a security fix for a vulnerability where an attacker could perform a Denial of Service against a CTFd instance. CTFd v2.2.0 to v3.7.3 are affected. We recommend all CTFd users update their instance to v3.7.4. If…
CTFd v3.3.1
CTFd v3.3.1 is available now with a security fix for an issue where users could join a team without knowing the team password or having a team invite. The malicious user would not have gained any additional permissions on the team or within CTFd, however it is possible…