Security: pwncollege/dojo
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
One-click root RCE in the CTFd container through unvalidated `files:` paths in `dojo.yml`GHSA-qwm2-mwg2-jm5g published
Aug 20, 2026 by ConnorNelsonCritical -
Stored XSS in Dojo Lecture Slides onclick HandlerGHSA-3mp3-cqfr-9crr published
Jul 28, 2026 by zardusHigh -
Hidden user activity exposed via unauthenticated API endpointGHSA-p423-qc2f-9j7g published
Jul 28, 2026 by zardusModerate -
Reflected XSS when updating identity in malicious courseGHSA-jx5q-94xm-9qvw published
Jul 28, 2026 by zardusHigh -
Reflected XSS when having invalid fields in dojo.ymlGHSA-qhrg-v6f4-x39m published
Jul 28, 2026 by zardusHigh -
LFI Through User Defined Dojo SurveysGHSA-j352-4cvg-q2hq published
Jul 28, 2026 by zardusHigh -
Self XSS when trying to reset home directory with unreadable filesGHSA-9952-242x-33c2 published
Jul 28, 2026 by zardusModerate -
Reflected XSS when creating a dojo with a malicious symlinkGHSA-8494-jw55-5fp4 published
Jul 28, 2026 by zardusHigh -
Reflected XSS when starting a challenge with invalid as_user url parameter as dojo ownerGHSA-qx75-jcgq-2jjg published
Jul 28, 2026 by zardusModerate -
Cross-user XSS through unescaped repository names and UI redressingGHSA-vx3h-hm5f-cfqq published
Jul 28, 2026 by zardusModerate