Information disclosure in Flagforge
CVE-2025-59833
Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deduction. Users can view all hints for free, undermining the business logic of the platform and reducing the integrity of the challenge system. This issue has been patched in version 2.3.0.
Vulnerability class: Information Disclosure
EPSS: 0.003 (24.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Flagforge
- Flagforgectf Flagforge — versions >= 2.1.0, < 2.3.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-59833?
- CVE-2025-59833 is a high-severity vulnerability in Flagforge, classified under Information Disclosure. CVSS score: 7.5/10. Published 2025-09-24.
- How severe is CVE-2025-59833?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-59833 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.