Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N P N L N 2.1 .0056 44.5 —
AFFECTED Product Versions Fixed CTFd 3.8.0 – —
TIMELINE Aug 23 EXPLOIT PUBLISHED — CVE-2026-78145 (CTFd). Public exploit reference added. Aug 23 Reserved by VulDB Aug 23 Published (CNA: VulDB) Aug 24 EXPLOIT PUBLISHED — CVE-2026-78145 (CTFd). Public exploit reference added.
A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.
| Date | Event | Detail |
|---|---|---|
| August 23, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-78145 (CTFd). Public exploit reference added. |
| August 23, 2026 | Reserved | Reserved by VulDB |
| August 23, 2026 | Published | Published (CNA: VulDB) |
| August 24, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-78145 (CTFd). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | CTFd | — | 3.8.0 | — |
Authoritative record: CVE-2026-78145 at cve.org
Weaknesses: CWE-601
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-78145 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
