What is the CVSS score of EUVD-2026-12868?

EUVD-2026-12868 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for EUVD-2026-12868?

Yes, a public proof-of-concept exploit is available for EUVD-2026-12868. Prioritise patching immediately. EPSS: 0.0%.

N A EUVD-2026-12868

| CVE-2026-30345 HIGH

Relative Path Traversal (CWE-23)

2026-03-18 mitre

Information Disclosure N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Apr 27, 2026 - 19:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Mar 18, 2026 - 17:15 euvd

EUVD-2026-12868

Analysis Generated

Mar 18, 2026 - 17:15 vuln.today

CVE Published

Mar 18, 2026 - 00:00 nvd

N/A

DescriptionCVE.org

A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside the intended directories via supplying a crafted import.

AnalysisAI

A zip slip vulnerability exists in CTFd v3.8.1-18-gdb5a18c4's Admin import functionality, allowing attackers to write arbitrary files outside intended directories by supplying a crafted import file. This path traversal vulnerability affects the CTFd Capture-The-Flag platform and can lead to information disclosure and potential remote code execution depending on file placement. A proof-of-concept exploit has been published on GitHub (syphonetic/CVE-2026-30345), and patch information is available in the CTFd v3.8.2 release blog post.

Technical ContextAI

This vulnerability is rooted in improper validation of file paths during ZIP archive extraction in the Admin import functionality. The underlying issue is a classic path traversal (CWE-22) vulnerability where zip archive entries containing relative path traversal sequences (such as '../../../') are not properly sanitized before extraction. The affected product is CTFd (cpe:2.3:a:ctfd:ctfd), a popular open-source Capture-The-Flag competition framework written in Python. The vulnerability exists in the import handler which processes ZIP files uploaded by administrators without validating that extracted files remain within the designated import directory, allowing attackers to write files to arbitrary locations on the filesystem such as application directories, configuration folders, or system-critical locations.

RemediationAI

Immediately upgrade CTFd to version 3.8.2 or later, as confirmed in the official CTFd blog release at https://blog.ctfd.io/ctfd-3-8-2/. If immediate patching is not possible, restrict administrative access to the CTFd import functionality to only trusted users, disable the import feature entirely via configuration if not required, and monitor file system changes in the CTFd application directory for suspicious activity. Additionally, implement operating system-level controls such as read-only filesystem mounts for critical application directories where feasible, and ensure proper file permissions prevent unauthorized execution of imported files. Review CTFd's official security policy at https://github.com/CTFd/CTFd/security/policy for any additional guidance or known workarounds.