CVE-2025-24886

pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specified dojos allows for users (admin not required) to perform an LFI from the CTFd container. When a user clones or updates repositories, a check is performed to see if the repository had contained any symlinks. A malicious user could craft a repository with symlinks pointed to sensitive files and then retrieve them using the CTFd website.

• CWE-61
• CWE-200

• https://github.com/pwncollege/dojo/security/advisories/GHSA-fcq8-jqq5-9xmh

Published

Jan 30, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-24876The SAP Approuter Node.js package version v16.7.1 and before…8.1
• CVE-2025-2488Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2025-24882regclient is a Docker and OCI Registry Client in Go. A malic…5.2
• CVE-2025-24883go-ethereum (geth) is a golang execution layer implementatio…8.7
• CVE-2025-24884kube-audit-rest is a simple logger of mutation/creation requ…5.1
• CVE-2025-24885pwn.college is an education platform to learn about, and pra…7.6
• CVE-2025-24887OpenCTI is an open-source cyber threat intelligence platform…6.3
• CVE-2025-24888The SecureDrop Client is a desktop application for journalis…8.1
• CVE-2025-24889The SecureDrop Client is a desktop application for journalis…4.5
• CVE-2025-2489Insecure information storage vulnerability in NTFS Tools ver…6.8
• CVE-2025-24891Dumb Drop is a file upload application. Users with permissio…9.6
• CVE-2025-24892OpenProject is open-source, web-based project management sof…5.4