Ctfer-io vulnerabilities
We track 10 vulnerabilities in Ctfer-io products across 5 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Ctfer-io vulnerabilities
- 7.1 High severity
terraform-provider-ctfd: Insufficiently Protected Credentials
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password without an addition
- 9.9 Critical severity
chall-manager: Improper Access Control
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPolicy, a malicious actor can pivot from an instance to any Pod out of the origin namespace. This breaks the secu
- 9.8 Critical severity
monitoring: Improper Limitation of a Pathname to a Restricted Directory
The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). In versions prior to 0.2.2, the sanitizeArchivePath function in pkg/extract/extract.go (lines 248–254) is vuln
- 9.8 Critical severity
fullchain: Improper Access Control
Fullchain is an umbrella project for deploying a ready-to-use CTF platform. In versions prior to 0.1.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from a subverted application to any Pod out of the origin namespace. The flawed inter-ns Net
- 7.5 High severity
romeo: Improper Limitation of a Pathname to a Restricted Directory
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the `sanitizeArchivePath` function in `webserver/api/v1/decoder.go`
- 10.0 Critical severity
romeo: Improper Access Control
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from
- 7.1 High severity
monitoring: Improper Access Control
The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). Prior to 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from a component to any other
- 7.5 High severity
chall-manager: Allocation of Resources Without Limits or Throttling
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. The HTTP Gateway processes headers, but with no timeout set. With a slow loris attack, an attacker could cause Denial of Service (DoS). Exploitation does not require au
- 9.8 Critical severity
chall-manager: Asymmetric Resource Consumption (Amplification)
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not req
- 9.1 Critical severity
chall-manager: Improper Limitation of a Pathname to a Restricted Directory
Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authenticat