CVE-2025-24886
pwn.college has Symlink LFI in Dojo repos
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
pwn.college has Symlink LFI in Dojo repos
pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specified dojos allows for users (admin not required) to perform an LFI from the CTFd container. When a user clones or updates repositories, a check is performed to see if the repository had contained any symlinks. A malicious user could craft a repository with symlinks pointed to sensitive files and then retrieve them using the CTFd website.
Reserved 2025-01-27 | Published 2025-01-30 | Updated 2025-01-31 | Assigner GitHub_MCWE-61: UNIX Symbolic Link (Symlink) Following
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
github.com/...e/dojo/security/advisories/GHSA-fcq8-jqq5-9xmh
Support options
