Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

pwn.college lets users read sensitive files via symlink trick

CVE-2025-24886 · published 1 year ago
Summary

The pwn.college learning platform does not properly check symbolic links when users add or update code repositories. A malicious user can create a repository containing links that point to files inside the system and then view those files through the website, even without admin rights. Administrators should upgrade to a version that validates links or restrict repository uploads to trusted sources.

Original advisory text
pwn.college has Symlink LFI in Dojo repos
pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specified dojos allows for users (admin not required) to perform an LFI from the CTFd container. When a user clones or updates repositories, a check is performed to see if the repository had contained any symlinks. A malicious user could craft a repository with symlinks pointed to sensitive files and then retrieve them using the CTFd website.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-61UNIX Symbolic Link (Symlink) Following
CWE-200Information Exposure
Timeline
Published30 Jan 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-24886 · NVD
CVE-2025-24886 · OSV
GHSA-fcq8-jqq5-9xmh · GHSA
Track software like this
Free during beta