PT-2025-39352 · Flagforge · Flagforge

Aryan4859 · Published 2025-09-24 · Updated 2025-10-08 · CVE-2025-59833

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flag Forge versions 2.1.0 through 2.2.9

Description Flag Forge is a Capture The Flag (CTF) platform. The API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them. This allows users to view all hints for free, undermining the platform’s business logic and reducing the integrity of the challenge system. The vulnerable parameter is id.

Recommendations Update to version 2.3.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-59833

GHSA-HM85-2J65-J8J2

Affected Products

Flagforge

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59833.json · Exploit
• https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-hm85-2j65-j8j2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59833 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59833 · Security Note
• https://t.me/CVEtracker/33304 · Telegram Post
• https://twitter.com/CVEnew/status/1970996069350924588 · Twitter Post
• https://t.me/cveNotify/137843 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971023181134680572 · Twitter Post