CVE-2025-24886: falha de alta gravidade em pwncollege dojo
pwn.college has Symlink LFI in Dojo repos
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.5%
pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specified dojos allows for users (admin not required) to perform an LFI from the CTFd container. When a user clones or updates repositories, a check is performed to see if the repository had contained any symlinks. A malicious user could craft a repository with symlinks pointed to sensitive files and then retrieve them using the CTFd website.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
pwncollege · dojoCVEs relacionadas — pwncollege dojo
No mesmo produto, das mais perigosas para as menos.
CVE-2026-25117HIGHpwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript executionEPSS 0.6%CVE-2025-62376CRITICALpwn.college DOJO vulnerable to improper authentication in workspace endpoint allowing unauthorized Windows VM accessEPSS 0.5%CVE-2025-24885HIGHpwn.college has a XSS on dojo pagesEPSS 0.2%