CVE-2025-24886: pwn.college Path Traversal Vulnerability

CVE-2025-24886 Overview

CVE-2025-24886 is a Local File Inclusion (LFI) vulnerability in pwn.college, an educational platform for hands-on cybersecurity training. The flaw resides in the dojo repository import workflow, where incorrect symbolic link validation allows authenticated users to read arbitrary files from the CTFd container. An attacker crafts a Git repository containing symlinks that point to sensitive files on the server. When the platform clones or updates the repository as a dojo, the symlinks are followed, and the targeted file contents become retrievable through the CTFd web interface. Administrative privileges are not required to exploit this issue, lowering the bar for abuse on multi-tenant deployments. The vulnerability is tracked under [CWE-61: UNIX Symbolic Link (Symlink) Following].

Critical Impact
Any authenticated user can read sensitive files inside the CTFd container, including configuration, credentials, and secrets accessible to the application process.

Affected Products

pwn.college dojo platform (upstream pwncollege/dojo repository)
CTFd container deployments running the vulnerable dojo integration
Self-hosted pwn.college instances prior to the patched commit

Discovery Timeline

2025-01-30 - CVE-2025-24886 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-24886

Vulnerability Analysis

The pwn.college dojo feature lets users import challenges by referencing a Git repository. During clone and update operations, the platform inspects the repository contents for symbolic links and is expected to reject or sanitize any that point outside the dojo working directory. The implemented check is incomplete, so symlinks that resolve to paths inside the CTFd container are accepted and later dereferenced when the application serves dojo assets. An attacker exploits this by publishing a repository whose tracked files are symlinks targeting host-side paths such as configuration files, environment files, or other application secrets. After importing the repository as a dojo, the attacker requests the corresponding asset through the CTFd web UI and receives the contents of the linked file. The issue is reachable over the network by any authenticated user, and the impact crosses a trust boundary because data from the CTFd container is disclosed to a low-privileged dojo author.

Root Cause

The root cause is improper symlink validation during repository ingestion. The pre-import check does not fully canonicalize link targets or enforce that they remain within the dojo content directory, leaving a classic symlink-following weakness.

Attack Vector

Exploitation requires only a valid pwn.college account and the ability to register a dojo. The attacker hosts a malicious Git repository, points a dojo at it, and triggers retrieval of the symlinked content through standard CTFd HTTP endpoints. See the GitHub Security Advisory for the upstream technical description.

Detection Methods for CVE-2025-24886

Indicators of Compromise

Dojo repositories whose tracked entries are symbolic links resolving outside the repository root, such as targets under /etc, /var, or CTFd application paths.
HTTP requests to CTFd dojo asset endpoints returning content types or sizes inconsistent with legitimate course material.
Unexpected reads of sensitive files (for example .env, configuration YAML, or private keys) by the CTFd process.

Detection Strategies

Inspect imported dojo repositories with find <repo> -type l -print and verify each link target with readlink -f to confirm it stays inside the repository.
Review CTFd access logs for repeated requests to dojo asset routes from a single low-privileged account shortly after a repository import or update.
Hunt for processes spawned by the CTFd container that open paths outside the expected dojo content directory.

Monitoring Recommendations

Enable file integrity monitoring on sensitive paths inside the CTFd container and alert on reads originating from the dojo workflow.
Log every dojo create and update event with the source repository URL, committer, and resulting file inventory for audit.
Correlate web access patterns with repository import timestamps to surface reconnaissance against newly imported content.

How to Mitigate CVE-2025-24886

Immediate Actions Required

Update the pwn.college dojo deployment to the version that includes the symlink validation fix referenced in the GitHub Security Advisory GHSA-fcq8-jqq5-9xmh.
Audit existing dojos for repositories containing symbolic links and remove or quarantine any that resolve outside the dojo directory.
Rotate any secrets, tokens, or credentials that may have been exposed through the CTFd container file system.

Patch Information

Apply the upstream patch from the pwncollege/dojo repository, which adds correct symlink target validation during clone and update operations. Self-hosted operators should pull the latest tagged release and rebuild the CTFd and dojo containers.

Workarounds

Restrict dojo creation to trusted users until the patched version is deployed.
Run the CTFd container with a read-only root filesystem and minimal mounted secrets so symlink dereferencing yields no sensitive content.
Pre-scan submitted repositories with a CI step that rejects any tracked symbolic links before the dojo workflow processes them.

bash

# Pre-import scan: reject repositories containing symlinks that escape the repo root
repo_root="$(pwd)"
while IFS= read -r -d '' link; do
  target="$(readlink -f "$link")"
  case "$target" in
    "$repo_root"/*) ;;
    *) echo "Rejecting unsafe symlink: $link -> $target"; exit 1 ;;
  esac
done < <(find . -type l -print0)