A critical zip slip vulnerability in CTFd allows unauthenticated remote attackers to perform arbitrary file writes, creating a significant risk of system compromise.

The vulnerability exists within the Admin import functionality of CTFd, where inadequate validation of zip file contents allows for path traversal. This permits an unauthenticated attacker to write arbitrary files outside of the intended directory structure.

Successful exploitation of this vulnerability allows an attacker to overwrite critical system files or upload malicious scripts, which can lead to full system compromise or remote code execution. Given the CVSS score of 7.5, this high-severity flaw poses a severe threat to the integrity of the hosting environment and the confidentiality of sensitive competition data.

Immediate Action: Update the CTFd instance to version 3.8.2 or later, as specified in the vendor security advisory.

Proactive Monitoring: Review web server and application access logs for unusual POST requests directed at the import functionality, particularly those containing path traversal sequences like double dots and slashes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file upload requests containing malicious path traversal patterns, although patching remains the primary requirement.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the researcher's write-up on GitHub and Gist.

This vulnerability represents a significant security risk due to the lack of authentication required to trigger the file write mechanism. Administrators should prioritize upgrading to the latest version of CTFd immediately to eliminate the underlying flaw. Failure to remediate could allow an attacker to gain persistent control over the server environment.