---
id: CVE-2025-59826
title: Flag Forge is a Capture The Flag (CTF) platform
summary: >-
  Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin
  users can create arbitrary challenges, potentially introducing malicious,
  incorrect, or misleading content. This issue has been patched in version
  2.2.0.
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L'
cwe:
  - CWE-862
vendor: flagforge
product: flagforge
affected:
  - flagforge = 2.1.0
published: '2025-09-23'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T20:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59826'
references:
  - url: >-
      https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-q7pg-qchv-3pc5
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.0023
epssPercentile: 0.12717
ingestedAt: '2026-10-12T14:50:33.985Z'
---

## Overview

Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing malicious, incorrect, or misleading content. This issue has been patched in version 2.2.0.

## Affected

- `flagforge = 2.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.