3.8.7

3.8.7 / 2026-08-19

Security

• Fix issue where the REST API could return the values of Custom Fields despite the field not being set to public
• Fix issue where a race condition could allow a user to submit more attempts than allowed by a challenge's max attempts setting

API

• Deprecate passing a list of fields as the view argument to schemas

3.8.6

3.8.6 / 2026-06-16

Security

• Fix issue where a malicious admin could disclose internal SMTP credentials

Admin Panel

• Add UI to mark a correct submission as incorrect

API

• Allow PATCH /api/v1/submissions/[submission_id] to mark submissions as incorrect

3.8.5

3.8.5 / 2026-05-19

Security

• Fix issue where the safe URL redirect validator could be bypassed on certain browsers possibly allowing an attacker the ability to phish other users

Translations

• Add Indonesian translations

API

• Fix issue when updating a challenge where initial, minimum, and decay could not be set to NULL even if the challenge function is static

Deployment

• Fix issue with subdirectory deployments where users could not authenticate on certain server configurations

3.8.4

3.8.4 / 2026-04-20

Security

• Fix issue where partially attacker controlled links could be served to other users possibly resulting in arbitrary JavaScript execution if those links are clicked
• Fix issue where the safe URL redirect validator could be bypassed possibly allowing an attacker the ability to phish other users

Deployment

• The REVERSE_PROXY config when set to true will now default to 1,1,1,1,0 instead of 1,1,1,1,1
• Update Pillow version to 12.2.0
• Update mako version to 1.3.11

3.8.3

3.8.3 / 2026-04-10

General

• Add Challenge position to improve control over challenge ordering
  • Positions of 0 go to the end and follow existing challenge sorting behavior. Otherwise position is increasing from 1 to n
• Use localized datetime formatting (datetimes will show in the user's preferred language format)
• Add anonymize setting to preview general details of challenges with prerequisites

Admin Panel

• Update progression matrix to support filters that are stored in the browser
• Add challenge category to progression matrix
• Add seperate frozen and unfrozen scoreboard CSV exports
  • The unfrozen scoreboard is the scoreboard-admin CSV export
• Add a CSV import & export for users with their team information
• Fix an issue where Page Preview could sometimes throw an error
• Fix error thrown in the Admin Panel when theme name is numeric

API

• /api/v1/hints/[hint_id] will now return 404 if the hint's associated challenge is hidden
• Add /api/v1/statistics/progression/matrix to support the progression matrix
• Add caching to /api/v1/users/[user_id]
• Add caching to /api/v1/teams/[team_id]
• Fix issue with bracket validation where users could join team brackets and vice-versa
• Make Content-Type checks more flexible when checking for JSON Content-Types
• Return description when returning a 401 error

Themes

• Fix regression in core theme where anonymous users would not be redirected to login on flag submit
• When restoring from a backup, set the theme from the backup if it is available, otherwise fall back to the default theme

Deployment

• Fix upload permissions error by using a sidecar container to set permissions in mounted folders
  • In CTFd 4.0 we will likely migrate to named volumes or similar to allow removal of this permissions sidecar container
• Disable CSRF check for static theme content on the views.themes_beta endpoint and when accessed via read-only methods

Translations

• Properly update included translations
• Add Serbian, Czech translations

3.8.2

3.8.2 / 2025-02-05

Security

• Fixes a vulnerability where a malicious admin user could import a crafted zip file to write files arbitrarily depending on the deployment

General

• When a user is submission ratelimited, those submissions will now be the ratelimit submission type instead of incorrect
• Fix issues with ratelimiting on max attempt challenges
• Switch max attempt timeout messaging to seconds instead of minutes
• Fix issue where users would get an error when solving an already solved challenge

Plugins

• Add Ratelimiteds submission class
• Add BaseChallenge.ratelimited() method which creates Ratelimiteds submissions
• Add force_all parameter to CTFd.plugins.migrations.upgrade() to allow plugins to decide if they want to force run all migrations
• Add app.overridden_functions global which allows plugin developers to override functions that support the behavior
• Raise ChallengeSolveException in BaseChallenge.solve() when encountering a duplicate solve situation

Themes

• Mark required fields in registration, login, and custom fields with a red asterisk

Deployment

• The provided Docker Compose file will no longer use the root user and instead use the provided ctfd user
• Add PUT method to IP address tracking

Translations

• Add Norwegian, Turkish, Croatian translation

3.8.1

3.8.1 / 2025-11-06

Security

• Make challenge attempt ratelimit stricter
• Make reset password ratelimit stricter and apply per-account

General

• Integrates dynamic scoring into the standard challenge type
  • All challenges will now have initial, decay, minimum, function columns available through the standard challenge type
  • Scoring logic for challenges can be configured with the function field
  • The dynamic value challenge plugin will remain supported until CTFd 4.0
• Add solved solution visibility to challenge solutions
  • This only allows a user to view a challenge's solution if they've solved the associated challenge

Admin Panel

• Add bulk editing for solution visibility in the Admin Panel Challenges page

API

• Change GET /api/v1/solutions/[solution_id] to return 404 if a solution is hidden instead of a 403
• Add /api/v1/challenges/[challenge_id]/solution endpoint to check if a challenge solution is accessible

Themes

• CTFd.js has been bumped to 0.0.19
• challenges.js now has additional functions getSolutionState and setSolutionId to allow the UI to determine if a solution is accessible

Deployment

• Fixes issues where preset admins would not be created
• Add RUN_ID config which specifies a token which will be used as a cache-buster URL parameter
• Add EXTRA_CONFIGS_FORCE_TYPES config to allow server admins to force types for configs specified in the [extra] section
• If UPDATE_CHECK is disabled the update prompt banner should be properly disabled
• Fix issue where users would be put into an infinite loop if confirm emails is enabled without having an email server configured

Translations

• Add Uzbek and Hebrew languages

3.8.0

3.8.0 / 2025-09-04

General

• Admins can now configure whether users can see their past submissions
• Admins can now store challenge solutions within CTFd to be viewed by users
• Participants can now leave upvotes/downvotes on challenges as well as their review of a challenge
  • Ratings/Votes can be configured to be viewed by participants or only admins
  • Reviews are only visible by admins
• Challenges now have the logic field which allows for challenge developers to control the flag collection behavior of a challenge:
  • any: any flag is accepted for the challenge
  • all: all flags for the challenge must be submitted
  • team: all team members must submit any flag
• Max Attempts can now behave as a timeout instead of a lockout
  • For example a user who submits 3 attempts will then be prevented from submitting another attempt for 5 minutes instead of being unable to submit entirely
• Social Shares for challenge completion are now enabled by default and admins may now control the social share template page
• Additional attempts after solving on challenges will now show if the submissions is correct/incorrect
• If email sending is available, email confirmation is enabled by default and users are nudged to complete email verification.
• Hints can now have a title that is shown before unlocking
• Hints now always require unlocking even if they require no cost
  • Prevents accidental viewing and improves tracking of hint usage
• CTFd will now store a tracking event under challenges.open in the Tracking table when a challenge is opened for the first time by a user
• Challenges now report whether a flag is correct or incorrect even if the challenge has already been solved
• Fixes issue where admins could not download challenge files before CTF start when downloading anonymously

Admin Panel

• Added a matrix scoreboard to the Statistics page to show player progression through the CTF
• Added support for brackets in the Admin Panel scoreboard
• Added config option for minimum password length
• Added config option to control whether players can view their previous submissions
• Admins can now require users to change their password upon login
• Added config option to control Max Attempts behavior
• In the Admin Panel challenge preview, admins now only see free hints
• Fixed issue where the hint form was not resetting properly when creating multiple hints

API

• Added /api/v1/users/me/submissions for users to retrieve their own submissions
• Added /api/v1/challenges/[challenge_id]/solutions for users to retrieve challenge solutions
• Added /api/v1/challenges/[challenge_id]/ratings for users to submit ratings and for admins to retrieve them
• Added ratings and rating fields to the response of /api/v1/challenges/[challenge_id]
• Added solution_id to the response of /api/v1/challenges/[challenge_id]
  • If no solution is available, the field is null
• Added logic field to the response of /api/v1/challenges/[challenge_id]
• Added change_password field to /api/v1/users/[user_id] when viewed as an admin
• Added /api/v1/solutions and /api/v1/solutions/[solution_id] endpoints
• /api/v1/unlocks is now also used to unlock solutions for user viewing

Deployment

• Added PRESET_ADMIN_NAME, PRESET_ADMIN_EMAIL, PRESET_ADMIN_PASSWORD, and PRESET_ADMIN_TOKEN to config.ini for pre-creating an admin user
  • Useful for automated deployments and ensuring a known admin token exists
• Added PRESET_CONFIGS to config.ini for pre-setting server-side configs
  • Useful for configuring CTFd without completing setup or using the API
• Added EMAIL_CONFIRMATION_REQUIRE_INTERACTION to config.ini to require additional interaction for email confirmation links
  • Improves compatibility with certain anti-phishing defenses
• Email confirmation is now enabled whenever email sending is available
• Replaced pybluemonday with nh3 (due to breakage in Python modules written in Golang)
• Updated Flask to 2.1.3
• Updated Werkzeug to 2.2.3

Plugins

• Challenge Type Plugins should now return a ChallengeResponse object instead of a (status, message) tuple
  • Existing behavior is supported until CTFd 4.0
• Added BaseChallenge.partial for challenge classes to indicate partial solves (for all flag logic)

Themes

• The core-beta theme has been promoted to core
  • The core-beta repo has been replaced with the core-theme repo. Future changes should be made in the main CTFd repo and these changes will be copied over to the core-theme repo.
• The previous core theme has been deprecated and renamed core-deprecated

3.7.7

3.7.7 / 2025-04-14

General

• Added ability to denylist/blacklist email domains from registering
• Hints can now include an optional title that is shown to users before unlocking

Admin Panel

• Challenge files now show the stored sha1sum

Deployment

• Fixed issue where the /api/v1/scoreboard/top/<count> endpoint wouldn't cache different count values properly
• The /api/v1/scoreboard/top/<count>endpoint will now return at most the top 50 accounts
• Updated gunicorn to 23.0.0
• Updated Jinja2 to 3.1.6

3.7.6

3.7.6 / 2025-02-19

Security

• Added the TRUSTED_HOSTS configuration to more easily restrict CTFd to valid host names

General

• Added language switcher on the main navigation bar
• Removed autocomplete=off from login, register, and reset password forms

Plugins

• Challenge type plugins can now raise ChallengeCreateException or ChallengeUpdateException to show input validation messages
• Plugins specifying a config route will now appear in the Admin Panel under the Plugins section

Translations

• Add Romanian, Greek, Finnish, Slovenian, Swedish languages