CVE-2026-78145 CTFd __init__.py _is_safe_url redirect
Attackers can exploit an open redirect in CTFd to redirect users to malicious sites, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-78145?
CVE-2026-78145 is a medium-severity vulnerability in CTFd, published on 23 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.
Weakness: CWE-601
Which versions are affected by CVE-2026-78145?
How do I fix CVE-2026-78145?
No fix has been published for CVE-2026-78145 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-78145 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-78145 exists.
Sources
Also known as GHSA-9x8r-fvqr-38vh.