CVE-2026-30345

HIGH EPSS 32.4%

Published Mar 18, 20263mo ago · Modified Jun 17, 20262w ago

7.5 CVSS 3.1

High

Published Mar 18, 2026 3mo ago

Last Modified Jun 17, 2026 2w ago

Description

A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside the intended directories via supplying a crafted import.

CVSS Details

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality None

Integrity High

Availability None

Threat Intelligence

EPSS Exploit Probability

32.4% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-23

References 5

blog.ctfd.io https://blog.ctfd.io/ctfd-3-8-2/
gist.github.com https://gist.github.com/syphonetic/2e16a6d1a44e7970c849a17efd0a2270
github.com https://github.com/CTFd/CTFd
github.com https://github.com/CTFd/CTFd/security/policy
github.com https://github.com/syphonetic/CVE-2026-30345

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.