CTFd

No entries match these filters. Clear filters

1. v1 Oct 26, 2026 · issue 121

   API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • ~ GET /unlocks: param ip (query) added; response schema changed
   • ~ POST /unlocks: response schema changed
   • GET /unlocks: param ip (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

2. docs update Oct 3, 2026 · issue 093

   CTFd adds Modules: named challenge groups with audience-scoped access control and staged release support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Stage a new challenge track for a specific team cohort before the competition opens, keeping challenges invisible until you are ready.
   📍1. Go to Admin Panel → Modules and click + to create a module named, e.g., Web Track. 2. Open the module and use Add challenges (Ctrl/Cmd-click) to add all web challenges, then click Add selected to this module. 3. Leave Linked Audiences empty — the module and its challenges are now invisible to all non-admins. 4. When ready to release, click Link audience and pick the target audience; challenges immediately become accessible to its members.
   Quickly assign a freshly created challenge to a module without leaving the challenge editor.
   📍1. Open the challenge in Admin Panel → Challenges. 2. Click the Module tab. 3. Choose the target module from the dropdown (or select 'none - ungrouped, visible to everyone'). 4. Click Save.
   • Adds a new Modules subsystem under Admin Panel → Modules that lets admins group challenges into named sets and release them only to specific Audiences, leaving ungrouped challenges visible to everyone as before.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds the Module tab on individual challenge pages under Admin Panel → Challenges, letting admins assign or reassign a module (or set none - ungrouped, visible to everyone) challenge-by-challenge.
   • Adds an Add challenges multi-picker on the module page that supports Ctrl/Cmd-click for bulk selection and automatically reassigns a challenge from its previous module when selected.
   • Adds a Linked Audiences section on each module page with Link audience and Unlink controls, so access to all challenges in a module can be granted or revoked per audience without touching individual challenges.
   • Modules act as a staging area: a module with no linked audiences is hidden from all non-admins, enabling pre-release challenge preparation without affecting the live competition.

   5 details in Everything

3. v1 Aug 4, 2026 · issue 035

   API surface changed: +18 endpoints, 4 modified

   API change

   API surface changed: +18 endpoints, 4 modified

   • + DELETE /audiences/{audience_id}
   • + DELETE /audiences/{audience_id}/members/{member_id}
   • + DELETE /modules/{module_id}
   • + DELETE /modules/{module_id}/audiences/{audience_id}
   • + GET /audiences
   • + GET /audiences/{audience_id}
   • + GET /audiences/{audience_id}/members
   • + GET /modules
   • + GET /modules/{module_id}
   • + GET /modules/{module_id}/audiences
   • + GET /modules/{module_id}/challenges
   • + PATCH /audiences/{audience_id}
   • + PATCH /modules/{module_id}
   • + POST /audiences
   • + POST /audiences/{audience_id}/members
   • + POST /modules
   • + POST /modules/{module_id}/audiences
   • + POST /modules/{module_id}/challenges
   • ~ GET /challenges: response schema changed
   • ~ GET /challenges/{challenge_id}: response schema changed
   • ~ PATCH /challenges/{challenge_id}: response schema changed
   • ~ POST /challenges: response schema changed
   • New endpoint DELETE /audiences/{audience_id}
   • New endpoint DELETE /audiences/{audience_id}/members/{member_id}
   • New endpoint DELETE /modules/{module_id}
   • New endpoint DELETE /modules/{module_id}/audiences/{audience_id}
   • New endpoint GET /audiences

   +17 more show less

   • New endpoint GET /audiences/{audience_id}
   • New endpoint GET /audiences/{audience_id}/members
   • New endpoint GET /modules
   • New endpoint GET /modules/{module_id}
   • New endpoint GET /modules/{module_id}/audiences
   • New endpoint GET /modules/{module_id}/challenges
   • New endpoint PATCH /audiences/{audience_id}
   • New endpoint PATCH /modules/{module_id}
   • New endpoint POST /audiences
   • New endpoint POST /audiences/{audience_id}/members
   • New endpoint POST /modules
   • New endpoint POST /modules/{module_id}/audiences
   • New endpoint POST /modules/{module_id}/challenges
   • GET /challenges: response schema changed
   • GET /challenges/{challenge_id}: response schema changed
   • PATCH /challenges/{challenge_id}: response schema changed
   • POST /challenges: response schema changed

   22 details in Everything

4. 3.8.6 Jun 16, 2026 · release notes

   CTFd 3.8.6 lets admins retroactively mark correct submissions as incorrect via UI and API.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.8.6 https://github.com/isislab/CTFd.git
   # already have the repo? check out this version:
   $ git checkout 3.8.6

   └──▷ TRY IT
   Retroactively invalidate a correct submission from the command line, e.g. after discovering a flag was leaked.
   copy

   $ curl -X PATCH https://<ctfd-host>/api/v1/submissions/<submission_id> \
     -H 'Authorization: Token <admin-token>' \
     -H 'Content-Type: application/json' \
     -d '{"type": "incorrect"}'

   Manually correct a mistakenly accepted submission directly in the admin panel without touching the API.
   📍In the Admin Panel, navigate to the submission in question and use the new Mark as Incorrect control to change its status.
   • New Admin Panel UI to mark a previously correct submission as incorrect.
   • Supports PATCH /api/v1/submissions/[submission_id] to programmatically mark submissions as incorrect.

   2 details in Everything

5. 3.8.6 Jun 16, 2026 · issue 007

   CTFd 3.8.6 adds admin UI and API support for reclassifying correct submissions as incorrect.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.8.6 https://github.com/CTFd/CTFd.git
   # already have the repo? check out this version:
   $ git checkout 3.8.6

   └──▷ TRY IT
   Programmatically revoke a correct submission (e.g., after detecting a flag-sharing violation) without touching the Admin UI.
   copy

   $ curl -X PATCH https://<ctfd-host>/api/v1/submissions/42 \
     -H 'Authorization: Token <admin-token>' \
     -H 'Content-Type: application/json' \
     -d '{"correct": false}'

   Manually invalidate a suspicious correct submission through the Admin Panel after reviewing solve logs.
   📍In the Admin Panel, go to Submissions, locate the correct submission, and click the new Mark as Incorrect action.
   • New Admin Panel UI to mark a previously correct submission as incorrect.
   • PATCH /api/v1/submissions/[submission_id] now supports marking submissions as incorrect via the API.

   2 details in Everything

6. 3.8.5 May 19, 2026 · release notes

   CTFd 3.8.5 adds Indonesian translations

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.8.5 https://github.com/isislab/CTFd.git
   # already have the repo? check out this version:
   $ git checkout 3.8.5

7. 3.8.3 Apr 11, 2026 · release notes

   CTFd 3.8.3 adds challenge positioning, localized datetimes, new progression matrix API, and Serbian/Czech translations.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.8.3 https://github.com/isislab/CTFd.git
   # already have the repo? check out this version:
   $ git checkout 3.8.3

   └──▷ TRY IT
   Pull progression matrix data programmatically to build custom reporting dashboards.
   copy

   $ curl -H 'Authorization: Token <admin_token>' https://<ctfd_host>/api/v1/statistics/progression/matrix

   Import users along with their team assignments in bulk before a CTF starts.
   📍In the Admin Panel, go to Users › Import/Export and upload a CSV file containing user and team information.
   • Adds Challenge Position field to control explicit ordering of challenges (1–n, with 0 falling to the end).
   • Supports localized datetime formatting so dates display in each user's preferred language format.
   • Adds anonymize setting to preview general details of challenges that have prerequisites.
   • Updates progression matrix with browser-stored filters and a new challenge category column.
   • Adds separate frozen and unfrozen scoreboard CSV exports (unfrozen available as scoreboard-admin CSV).

   +6 more show less

   • Adds CSV import & export for users that includes their team information.
   • New /api/v1/statistics/progression/matrix endpoint backing the progression matrix view.
   • Adds response caching to /api/v1/users/[user_id] and /api/v1/teams/[team_id].
   • Returns a description field in 401 error responses from the API.
   • Adds Serbian and Czech translations.
   • When restoring from a backup, automatically applies the theme from the backup if available, falling back to the default.

   11 details in Everything

8. 3.8.2 Feb 5, 2026 · release notes

   CTFd 3.8.2 adds ratelimit submission tracking, new plugin APIs, Norwegian/Turkish/Croatian translations, and a rootless Docker Compose default.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.8.2 https://github.com/isislab/CTFd.git
   # already have the repo? check out this version:
   $ git checkout 3.8.2

   • Adds ratelimit submission type so rate-limited attempts are tracked separately from incorrect submissions.
   • Adds Ratelimiteds submission class and BaseChallenge.ratelimited() method for plugin developers to create rate-limited submission records.
   • Adds force_all parameter to CTFd.plugins.migrations.upgrade() enabling plugins to force-run all migrations.
   • Adds app.overridden_functions global allowing plugins to override supported platform functions.
   • Raises ChallengeSolveException in BaseChallenge.solve() when a duplicate solve is encountered, giving plugins a consistent signal to handle.

   +4 more show less

   • Adds PUT method to IP address tracking endpoint.
   • Required fields in registration, login, and custom field forms are now marked with a red asterisk.
   • Adds Norwegian, Turkish, and Croatian translations.
   • Docker Compose deployment now runs as the ctfd user instead of root.

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The provided Docker Compose file no longer uses the root user and instead uses the ctfd user — file permission mappings tied to root in existing deployments may break on upgrade.
9. 3.8.1 Nov 6, 2025 · release notes

   CTFd 3.8.1 integrates dynamic scoring into standard challenges and adds solution-access controls with new API endpoints.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 3.8.1 https://github.com/isislab/CTFd.git
   # already have the repo? check out this version:
   $ git checkout 3.8.1

   └──▷ HOW TO FIND IT
   Bulk-set solution visibility to solved for multiple challenges so participants can only read solutions they've already completed.
   📍In the Admin Panel, go to Challenges, select the target challenges using the checkboxes, open the Bulk Edit menu, and set Solution Visibility to solved.
   • Integrates dynamic scoring into the standard challenge type — all challenges now support initial, decay, minimum, and function fields for configurable scoring logic, removing the need for a separate plugin.
   • Adds solved solution visibility mode, letting users view a challenge's solution only after they have solved it.
   • Adds bulk editing for solution visibility on the Admin Panel Challenges page.
   • New /api/v1/challenges/[challenge_id]/solution endpoint to check whether a challenge solution is accessible to the requesting user.
   • Changes GET /api/v1/solutions/[solution_id] to return 404 instead of 403 for hidden solutions.

   +4 more show less

   • New RUN_ID config option specifies a token used as a cache-buster URL parameter.
   • New EXTRA_CONFIGS_FORCE_TYPES config allows server admins to enforce types for values in the [extra] config section.
   • Adds Uzbek and Hebrew language translations.
   • CTFd.js bumped to 0.0.19, adding getSolutionState and setSolutionId functions for theme developers to determine solution accessibility.

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !GET /api/v1/solutions/[solution_id] now returns 404 (not 403) when a solution is hidden — clients that branch on 403 to detect hidden solutions will need to be updated.
10. 3.8.0 Sep 4, 2025 · release notes

    CTFd 3.8.0 adds challenge ratings, multi-flag logic, solution storage, bracket scoreboards, and automated deployment presets.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.8.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.8.0

    └──▷ USE IT
    Pre-create an admin account and set a known API token for fully automated CTFd deployments (CI/CD pipelines, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup.).
    ini copy

    # config.ini
    [server]
    PRESET_ADMIN_NAME = admin
    PRESET_ADMIN_EMAIL = admin@example.com
    PRESET_ADMIN_PASSWORD = Ch4ng3Me!
    PRESET_ADMIN_TOKEN = my-known-api-token

    Retrieve all ratings submitted for a challenge to gauge difficulty or quality feedback from participants.
    copy

    $ curl https://ctfd.example.com/api/v1/challenges/42/ratings \
      -H 'Authorization: Token my-known-api-token'

    • Adds configurable visibility for users' own past submissions via new /api/v1/users/me/submissions endpoint and admin toggle.
    • Admins can now store and publish challenge solutions, accessible to users via /api/v1/challenges/[challenge_id]/solutions and unlocked through /api/v1/unlocks.
    • New challenge logic field lets developers require any single flag (any), all flags (all), or a flag from every team member (team) before a solve is counted.
    • Max Attempts can now act as a timed cooldown (e.g., 5-minute lockout) rather than a permanent lockout.
    • Participants can submit upvotes/downvotes and written reviews on challenges via /api/v1/challenges/[challenge_id]/ratings; visibility is admin-configurable.

    +12 more show less

    • Hints now require an explicit unlock action even when free, improving accidental-view prevention and hint-usage tracking.
    • Hints can now be given a title shown to users before they unlock the hint.
    • CTFd logs a challenges.open tracking event in the Tracking table the first time a user opens a challenge.
    • Adds a matrix scoreboard to the Admin Panel Statistics page to visualise player progression through challenges.
    • Admin Panel scoreboard now supports brackets.
    • New admin config option for minimum password length.
    • Admins can now force users to change their password on next login via the change_password field on /api/v1/users/[user_id].
    • New PRESET_ADMIN_NAME, PRESET_ADMIN_EMAIL, PRESET_ADMIN_PASSWORD, and PRESET_ADMIN_TOKEN keys in config.ini for pre-creating an admin account in automated deployments.
    • New PRESET_CONFIGS key in config.ini allows pre-setting server-side configuration without completing the setup wizard or using the API.
    • New EMAIL_CONFIRMATION_REQUIRE_INTERACTION key in config.ini requires additional user interaction on confirmation links to improve anti-phishing compatibility.
    • Adds BaseChallenge.partial for plugin authors to indicate partial solves used with all-logic challenges.
    • The core-beta theme is promoted to core; the previous core theme is renamed core-deprecated.

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Challenge Type Plugins must now return a ChallengeResponse object instead of a (status, message) tuple (legacy tuple behavior is supported until CTFd 4.0).
    • !The core-beta theme is renamed to core; the previous core theme is renamed core-deprecated — any theme references to core or core-beta in deployments will resolve to different themes after upgrade.
    • !pybluemonday is replaced with nh3 for HTML sanitisation — any plugin or deployment that depends directly on pybluemonday will break.
11. 3.7.7 Apr 15, 2025 · release notes

    CTFd 3.7.7 adds email domain denylisting, titled hints, and SHA1 sums for challenge files.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.7 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.7.7

    • Adds ability to denylist/blacklist email domains from registering, blocking unwanted participants at sign-up.
    • Hints can now include an optional title shown to users before they unlock the hint.
    • Challenge files in the Admin Panel now display their stored SHA1 checksum for integrity verification.
    • The /api/v1/scoreboard/top/<count> endpoint now enforces a maximum return of top 50 accounts.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The /api/v1/scoreboard/top/<count> endpoint now returns at most the top 50 accounts; requests for counts above 50 will be capped.
12. 3.7.6 Feb 20, 2025 · release notes

    CTFd 3.7.6 adds trusted host restrictions, a language switcher, new locales, and richer plugin APIs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.6 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.7.6

    • Adds TRUSTED_HOSTS configuration to restrict CTFd to allowlisted host names, hardening against host-header attacks.
    • New language switcher in the main navigation bar lets users change the UI language without admin intervention.
    • Adds Romanian, Greek, Finnish, Slovenian, and Swedish translations.
    • Challenge type plugins can now raise ChallengeCreateException or ChallengeUpdateException to surface input validation messages to users.
    • Plugins that specify a config route now automatically appear in the Admin Panel under the Plugins section.

    5 details in Everything

13. 3.7.5 Dec 28, 2024 · release notes

    CTFd 3.7.5 adds a category point breakdown graph, bracket data in CSV exports, and language selection in the nav bar.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.5 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.7.5

    └──▷ HOW TO FIND IT
    Pull bracket metadata programmatically from scoreboard CSV exports for post-CTF analysis or reporting.
    📍In the Admin Panel, go to Scoreboard › Export and download the CSV — the exported file now includes Bracket ID and Bracket Name columns.
    • Adds a point breakdown graph in the Admin Panel showing challenge points allocated per category.
    • Adds Bracket ID and Bracket Name columns to CSV scoreboard exports.
    • Adds language selection to the main theme navigation bar.
    • Supports setting a password without requiring a previous password confirmation when a user or team has no password set.
    • Splits /api/v1/flags/types and /api/v1/flags/types/<type_name> into two separate controllers.

    +1 more show less

    • Improves IP tracking performance by only recording IPs not previously seen or on state-changing methods.

    6 details in Everything

14. 3.7.4 Oct 9, 2024 · release notes

    CTFd 3.7.4 adds challenge attribution fields, bracket display, dark mode, and customizable ECharts graph options.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.4 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.7.4

    └──▷ USE IT
    Customize the scoreboard chart appearance (e.g., change colors or disable animations) without modifying CTFd core files.
    javascript copy

    window.scoreboardChartOptions = { color: ['#ff6384', '#36a2eb'], animation: false };

    • Adds an attribution field to Challenges for crediting challenge authors or sources.
    • Displays brackets in the Admin Panel and on user/team listing and profile pages.
    • Adds dark mode to the core-beta theme.
    • Enables overriding ECharts scoreboard and score-graph behavior via window.scoreboardChartOptions, window.teamScoreGraphChartOptions, and window.userScoreGraphChartOptions window objects.
    • Adds type and extra arguments to Assets.js() with defer defaulting to False.

    +1 more show less

    • Updates the scoreboard score graph to reflect the currently active bracket.

    6 details in Everything

15. 3.7.3 Jul 24, 2024 · release notes

    CTFd 3.7.3 adds admin-configurable default language and a new Catalan translation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.3 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.7.3

    └──▷ HOW TO FIND IT
    Override browser-detected languages so all users see CTFd in a consistent locale by default.
    📍In the Admin Panel, go to Config › Localization and set the Default Language to your desired locale (e.g. en for English).
    • Adds a Localization section to the Admin Config Panel for managing language settings.
    • New Default Language config option lets admins set a platform-wide language instead of relying on each user's browser auto-detection.
    • Adds Catalan as a supported translation language.

    3 details in Everything

16. 3.7.2 Jun 18, 2024 · release notes

    CTFd 3.7.2 adds CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. policy configuration and changes pagination API responses

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.2 https://github.com/CTFd/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.7.2

    └──▷ USE IT
    Configure the Cross-Origin-Opener-Policy header via environment variable
    shell copy

    export CROSS_ORIGIN_OPENER_POLICY=same-origin-allow-popups

    • Adds CROSS_ORIGIN_OPENER_POLICY setting to control the Cross-Origin-Opener-Policy header
    • Listing pages now return HTTP 200 with empty listings instead of 404 when no items are found

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !API endpoints returning pagination results now return HTTP 200 with an empty list body on failure instead of HTTP 404, which may break clients expecting a 404 status code for empty/not found states.
17. 3.7.1 Jun 1, 2024 · release notes

    CTFd 3.7.1 adds raw export API, debug endpoint, plugin config templates, and defer support in Assets.js

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.1 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.7.1

    • Adds serializeJSON function back into the Admin Panel
    • Adds /api/v1/exports/raw API endpoint to allow for exports to be generated via the API
    • Adds a query parameter to ScoreboardDetail endpoint (/api/v1/scoreboard/top/<count>) to filter by bracket
    • Return function field for DynamicValue challenges data read
    • Add defer parameter to Assets.js() to allow controlling the defer attribute of inserted <script> tags

    +3 more show less

    • Plugins can now define a config entry in config.json to define a template to embed into the Config Panel
    • Add the make_cache_key_with_query_string to allow for caching based on query string arguments
    • Add the /debug endpoint to show CTFd debugging information

    8 details in Everything

18. 3.7.0 Feb 26, 2024 · release notes

    CTFd 3.7.0 adds scoreboard brackets, file sha1sum, API-controlled upload locations, and S3 custom prefixes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.7.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.7.0

    └──▷ TRY IT
    Check which scoreboard bracket a user belongs to via the API.
    copy

    $ curl -s https://ctf.example.com/api/v1/scoreboard | jq '.data[0].bracket_name'

    • /api/v1/scoreboard now returns bracket_name and bracket_id to support sub-scoreboards
    • GET /api/v1/files includes a sha1sum field for local change detection
    • POST /api/v1/files accepts a location parameter to control upload destination
    • Config key AWS_S3_CUSTOM_PREFIX allows S3 file uploads under a specific folder prefix
    • New Jinja filter unix_time_to_utc() available in theme templates

    5 details in Everything

19. 3.6.1 Dec 13, 2023 · release notes

    CTFd 3.6.1 adds email search API fields and multipart file upload support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.6.1 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.6.1

    └──▷ TRY IT
    Search for a user by email address using the CTFd API.
    copy

    $ curl -s -H "Authorization: Token <your_token>" "https://ctf.example.com/api/v1/users?field=email&search=target@example.com"

    Upload a file using multipart form data with token auth.
    copy

    $ curl -X POST -H "Authorization: Token <your_token>" -F "file=@/path/to/file.jpg" https://ctf.example.com/api/v1/files

    • email field now supported in query parameters for /api/v1/users and /api/v1/teams endpoints to allow searching via email address.
    • /api/v1/files accepts multipart/form-data with token authentication for file uploads.

    2 details in Everything

20. 3.6.0 Aug 21, 2023 · release notes

    CTFd 3.6.0 adds discard submissions, S3 addressing styles, dynamic challenge math, and HTML sanitization config

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.6.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.6.0

    └──▷ TRY IT
    Correct a mistakenly rejected flag submission for a team member.
    copy

    $ curl -X PATCH https://<ctfd-url>/api/v1/submissions/<submission_id> \
      -H 'Authorization: Token <token>' \
      -H 'Content-Type: application/json' \
      -d '{"type": "discard"}'

    Enable HTML sanitization for challenge descriptions via the admin panel.
    📍In the Admin Panel, go to Configuration and enable HTML Sanitization.
    • Adds PATCH /api/v1/submissions/[submission_id] endpoint to mark incorrect submissions as correct
    • Adds discard submission type to allow marking failed attempts as valid
    • Adds HTML_SANITIZATION config option in the Admin Panel's Config section and config.ini
    • Adds AWS_S3_ADDRESSING_STYLE config to select S3 bucket addressing (auto, virtual, path)
    • Adds AWS_S3_CUSTOM_DOMAIN config to override presigned download URL domains for custom S3 providers

    +3 more show less

    • Adds SKIP_DB_PING environment variable to skip database availability checks in the Docker image
    • Allows dynamic value challenges to use linear or logarithmic decay functions for scoring
    • Shows free hints to unauthenticated users when the challenge itself is visible to them

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Custom fields named Affiliation or 'Website no longer automatically set the user's affiliation or website profile fields
21. 3.5.2 May 2, 2023 · release notes

    3.5.2 adds admin control over robots.txt and supports S3 URL generation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.5.2 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.5.2

    • Adds robots.txt configuration controls in the Admin Panel for administrators to manage robot access rules
    • Enables generation of cachable S3 URLs by rounding timestamps down to the previous hour

    2 details in Everything

22. 3.5.1 Jan 24, 2023 · release notes

    CTFd 3.5.1 adds notification cursor API, granular DB/Redis env vars, S3 region config, teams CSV export, and plugin config paths

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.5.1 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.5.1

    └──▷ USE IT
    Configure database connection using individual environment variables instead of DATABASE_URL
    shell copy

    export DATABASE_PROTOCOL="postgresql"
    export DATABASE_USER="ctfd_user"
    export DATABASE_PASSWORD="secret"
    export DATABASE_HOST="db.example.com"
    export DATABASE_PORT="5432"
    export DATABASE_NAME="ctfd_db"

    • Add HEAD /api/v1/notifications endpoint with optional since_id query parameter to retrieve unread notification counts or filtered updates
    • Add since_id query parameter to GET /api/v1/notifications to fetch notifications occurring after a specific ID
    • Add individual environment variable config keys for database connection: DATABASE_PROTOCOL, DATABASE_USER, DATABASE_PASSWORD, DATABASE_HOST, DATABASE_PORT, and DATABASE_NAME as an alternative to DATABASE_URL
    • Add individual environment variable config keys for Redis connection: REDIS_PROTOCOL, REDIS_USER, REDIS_PASSWORD, REDIS_HOST, REDIS_PORT, and REDIS_DB as an alternative to REDIS_URL
    • Add AWS_S3_REGION configuration key (defaulting to us-east-1) to specify the S3 region for storage

    +3 more show less

    • Add CSV export format teams+members+fields including teams with custom fields and their members' custom field entries to the Admin Panel import/export flow
    • Allow plugins to specify multiple paths in config.json to add additional entries to the Plugins dropdown in the Admin Panel
    • Expose CTFd.utils.email.providers.EmailProvider, MailgunEmailProvider, and SMTPEmailProvider classes for customizing email sending via plugins

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The beta interface Assets.manifest_css has been removed; plugins or themes referencing it will fail at runtime.
23. 3.5.0 May 10, 2022 · release notes

    CTFd 3.5.0 adds background import tracking via GET /admin/import, new count meta fields on API endpoints, and --delete_import_on_finish CLI flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.5.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.5.0

    └──▷ USE IT
    Check the status of a background CTF import to know when it finishes
    shell copy

    curl -s http://<ctfd_host>/admin/import | jq .

    Import a CTFd backup and automatically remove the file upon completion
    copy

    $ python manage.py import_ctf <path_to_backup> --delete_import_on_finish

    Retrieve paginated user solves using the new count meta field for progress tracking in UI
    shell copy

    curl https://<ctfd_host>/api/v1/users/me/solves?page=2 | jq '.meta.count'

    • Add progress tracking to backup/export importing with status accessible via GET /admin/import
    • Add the count meta field to /api/v1/users/me/solves, /api/v1/users/me/fails, /api/v1/users/me/awards, /api/v1/teams/me/awards, /api/v1/users/[user_id]/solves, /api/v1/users/[user_id]/fails, /api/v1/users/[user_id]/awards, /api/v1/teams/[team_id]/solves, and /api/v1/teams/[team_id]/awards
    • Add --delete_import_on_finish to python manage.py import_ctf
    • Add city geolocation to Team Profile IP addresses
    • Add links from User/Team Profile IP addresses to a User IP address search page

    +5 more show less

    • Add support for only viewing hints after unlocking another hint
    • Add next challenge recommendation to challenges
    • Add userName, userEmail, teamId, and teamName to the CTFd init object in base.html
    • Adds the Assets constant to access front end assets from Jinja templates
    • Add views.themes_beta route to avoid .dev/.min extension on frontend asset urls

    10 details in Everything

24. 3.4.1 Feb 19, 2022 · release notes

    CTFd 3.4.1 adds S3 SigV4SigV4AWS's request-signing protocol that authenticates HTTP calls by hashing the request body, headers, and credentials into a signature; cyber tools use it to talk to AWS APIs without embedding long-lived secrets. support for alternate buckets and configurable per-minute submission limits.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.1 https://github.com/CTFd/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.4.1

    • deployments.s3_signature_version supports S3 signature version 4 authentication to allow storage in alternative S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. buckets like Google Cloud Storage or DigitalOcean Spaces
    • Admin Panel allows configuring the submissions-per-minute ratelimit via a new configuration key rather than a hardcoded default

    2 details in Everything

25. 3.4.0 Aug 12, 2021 · release notes

    CTFd 3.4.0 adds Challenge Topics API, CSV import, registration passwords, and HTML page support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.4.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.4.0

    • Adds /api/v1/topics endpoint for creating/deleting challenge topics.
    • Adds /api/v1/challenges/[challenge_id]/topics endpoint for managing challenge-topic associations.
    • Adds connection_info field to Challenge models and the /api/v1/challenges/[challenge_id] API response.
    • Adds ability to import users, teams, and challenges via CSV files in the Admin Panel.
    • Adds support for limiting the total number of teams in a CTF.

    +4 more show less

    • Adds THEME_FALLBACK configuration option (default: true) to allow incomplete themes to fall back to the core theme.
    • Adds registration password requirement capability, restricting account creation until a specified password is provided.
    • Enables Admin Panel users to write Pages using raw HTML instead of only Markdown.
    • Adds window.BETA_sortChallenges, window.updateChallengeBoard, and window.updateScoreboard global hooks for theme developers to control client-side updates.

    9 details in Everything

26. 3.3.0 Mar 27, 2021 · release notes

    CTFd 3.3.0 adds solve counts and solved_by_me fields to challenge API, plus theme inheritance and TEAM_DISABLE_PUBLIC_CREATION config.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.3.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.3.0

    • Adds THEME_FALLBACK config key to enable fallback to the core theme during development
    • Adds team_id field to GET /api/v1/users responses to check team membership
    • Adds solves and solved_by_me fields to /api/v1/challenges and /api/v1/challenges/[challenge_id] endpoints
    • Allows themes to inherit from other themes using {% extends 'core/page.html' %} syntax

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Rewrites HTML sanitization (controlled by HTML_SANITIZATION) to use pybluemonday instead of lxml/html5lib, potentially changing output for edge cases
27. 3.2.0 Dec 7, 2020 · release notes

    CTFd 3.2.0 adds Team invite tokens via new POST endpoint and notifications HTML parameter.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.2.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.2.0

    └──▷ USE IT
    Generate a token for a user to join your team without knowing the password.
    shell copy

    curl -X POST https://ctfd.example.com/api/v1/teams/me/members \
      -H 'Authorization: Token <your_api_key>' \
      -H 'Content-Type: application/json'

    Retrieve a notification including its rendered HTML version.
    shell copy

    curl https://ctfd.example.com/api/v1/notifications/<notification_id>?html=1 \
      -H 'Authorization: Token <your_api_key>'

    • Adds POST /api/v1/teams/me/members endpoint to generate team invite tokens.
    • Adds html parameter to /api/v1/notifications and /api/v1/notifications/[notification_id] for rendered content.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default value for the UPLOAD_PROVIDER config key is no longer filesystem; it now defaults through config.py.
28. 3.1.1 Sep 22, 2020 · release notes

    Adds MAILSENDER_ADDR config key to override SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. sender header

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.1 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.1.1

29. 3.1.0 Sep 8, 2020 · release notes

    CTFd 3.1.0 adds custom registration fields, admin comments API /api/v1/comments, and --disable-gevent CLI flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.1.0

    └──▷ TRY IT
    Run the CTFd service without gevent for debugging or specific deployment requirements.
    copy

    $ python manage.py serve --disable-gevent

    Create a comment on a specific challenge via the API.
    copy

    $ curl -X POST http://localhost:4000/api/v1/comments \
      -H 'Content-Type: application/json' \
      -d '{"type": "challenge", "id": 1, "content": "Admin note"}'

    Define custom fields for registration by configuring the Admin Panel's Custom Fields section.
    📍In the Admin Panel, navigate to Configs › Custom Fields and define user/team fields.
    • Adds --disable-gevent flag to serve.py to run without gevent
    • Adds /api/v1/comments endpoint for managing challenge, user, team, and page comments
    • Adds ability to configure custom user and team fields via the Admin Panel's Custom Fields section

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !subscribe() in CTFd.utils.events.EventManager no longer implements subscription logic; it now only handles passing notifications from CTFd to the browser, requiring custom implementation of subscription via the new listen() method.
30. 3.0.1 Aug 13, 2020 · release notes

    Admin Panel adds filtering by Account/Challenge IDs and names; config.ini precedence logic defined.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.1 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.0.1

    • Adds filters for Account ID, Challenge ID, and Challenge Name to the Admin Panel Submissions page
    • Configures config.ini values to supersede environment variables when both are present for a given key

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !config.ini values now take precedence over environment variables for the same key, potentially overriding prior environment-based defaults.
31. 3.0.0 Jul 27, 2020 · release notes

    CTFd v3 adds server-side HTML sanitization, new Jinja globals for configs and forms, and structured API responses

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.0.0

    • Adds HTML_SANITIZATION configuration key to enable server-side stripping of malicious JavaScript or HTML in rendered content.
    • Introduces Configs global in Jinja templates for wrapped access to get_config (e.g., {{ Configs.ctf_name }}).
    • Introduces Forms global in Jinja templates to access WTForms instances directly (e.g., {{ Forms.auth.LoginForm() }}).
    • Changes GET /api/v1/config/<config_key> to return structured data according to ConfigSchema instead of raw values.
    • Adds html item to the response of GET /api/v1/hints/[hint_id] containing the server-rendered HTML of the hint.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !config.py is deprecated for configuration; users must now edit config.ini or use environment variables in docker-compose.yml.
    • !Old theme globals like {{ nonce }} and {{ id }} are removed; they must now be accessed via {{ Session.nonce }}.
    • !get_config('ctf_name') is no longer the primary access method in templates; use the new Configs global instead.
    • !Mailgun email settings are deprecated in favor of SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. email settings.
    • !PostgreSQL is no longer a main database backend; support is considered second-class and unsupported for many features.
32. 3.0.0b3 Prerelease Jul 22, 2020 · release notes

    CTFd 3.0.0b3 adds rendered HTML to Hint API and removes raw content from list endpoint

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.0b3 https://github.com/CTFd/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.0.0b3

    • Adds html field to GET /api/v1/hints/[hint_id] response containing rendered HTML of the hint content
    • Removes content field from GET /api/v1/hints endpoint response

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The content field is removed from the GET /api/v1/hints endpoint response; clients relying on this field for raw hint text will receive null or missing data.
33. 3.0.0b2 / 2020-07-19 Prerelease Jul 19, 2020 · release notes

    CTFd 3.0.0b2 adds configurable HTML sanitization via HTML_SANITIZATION in config.ini

    • Makes HTML sanitization an optional setting controllable by the HTML_SANITIZATION config key in config.ini
    • Allows HTML comments through the sanitization process
    • Allows Bootstrap data attributes through the sanitization process

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !HTML sanitization is now optional instead of enforced, controlled by the new HTML_SANITIZATION setting in config.ini
34. 3.0.0a2 Prerelease Jul 9, 2020 · release notes

    CTFd 3.0.0a2 introduces custom registration fields and a redesigned admin challenge form.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.0a2 https://github.com/CTFd/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 3.0.0a2

    • affiliation, website, and country can now be accepted as additional profile fields during user registration (themes must provide the corresponding inputs)

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The PATCH /api/v1/users/[user_id] endpoint no longer allows admins to ban themselves, preventing self-banning scenarios that were previously possible.
35. 3.0.0a1 / 2020-07-01 Prerelease Jul 1, 2020 · release notes

    CTFd v3.0.0a1 introduces GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. lookup, Configs/Forms Jinja globals, challenge view API endpoint, and CommonMark rendering.

    • Add GeoIP support to convert user IP addresses into guessed countries.
    • Inject Config, User, Team, Session, and Plugin globals into Jinja templates.
    • Make almost all API endpoints provide filtering and searching capabilities via query parameters.
    • Change GET /api/v1/config/<config_key> to return structured data according to ConfigSchema.
    • Add Configs global to themes for wrapped access to get_config (e.g. {{ Configs.ctf_name }}).

    +5 more show less

    • Add Forms global to Jinja templates via wtforms for easier form rendering ({{ Forms }}).
    • Allow themes to provide a settings JSON blob accessible in Jinja as {{ Configs.theme_settings }}."
    • Expose challenge view content via /api/v1/challenges/<challenge_id> in the view section.
    • Add fields keyword argument to get_standings(), get_team_standings(), and get_user_standings() for custom field selection.
    • Allow flags to control user messages by raising FlagException.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Mailgun email settings are deprecated; admins must move to SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. email settings.
    • !PostgreSQL is no longer a main database backend and is treated as unsupported for official purposes.
    • !config.py editing for configuration is deprecated in favor of config.ini or environment variables.
    • !Challenge plugins must now specify a challenge.html in the theme to define rendering structure.
36. 2.5.0 Jun 4, 2020 · release notes

    Admin-only API views and performance boosts for CTFd 2.5.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.5.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.5.0

    └──▷ TRY IT
    Retrieve the full list of challenges, including those currently hidden from players.
    copy

    $ curl -X GET http://localhost:4000/api/v1/challenges?view=admin

    Fetch all user accounts, including those banned or hidden by administrators.
    copy

    $ curl -X GET http://localhost:4000/api/v1/users?view=admin

    View all team entities, bypassing visibility restrictions on hidden or banned teams.
    copy

    $ curl -X GET http://localhost:4000/api/v1/teams?view=admin

    • Adds /api/v1/challenges?view=admin endpoint to let admins see all challenges regardless of visibility state
    • Adds /api/v1/users?view=admin endpoint to let admins see all users regardless of hidden/banned state
    • Adds /api/v1/teams?view=admin endpoint to let admins see all teams regardless of hidden/banned state

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The scoreboard endpoint /api/v1/scoreboard will no longer show hidden/banned users in a non-hidden team
37. 2.4.3 May 25, 2020 · release notes

    Adds plugin API methods and ensures file deletion via DELETE endpoint

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.3 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.4.3

    • Add CTFd.plugins.get_plugin_names() to get a list of available plugins
    • Add CTFd.plugins.migrations.current() to get the current revision of a plugin migration
    • Improve CTFd.plugins.migrations.upgrade() to be able to upgrade to a specific plugin migration
    • File deletion endpoint (DELETE /api/v1/files/[file_id]) will now correctly delete the associated file

    4 details in Everything

38. 2.4.2 May 9, 2020 · release notes

    Adds plugin migration support and app.plugins_dir config for CTFd v2.4.2

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.2 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.4.2

    └──▷ USE IT
    Update a plugin's initialization code to use the new migration system instead of creating tables manually.
    python copy

    import CTFd.plugins.migrations
    
    # Inside your plugin setup function:
    CTFd.plugins.migrations.upgrade()

    Access the directory path where plugins are installed within application code.
    python copy

    plugins_directory = app.plugins_dir

    • Adds the CTFd.plugins.migrations module with an upgrade function for plugin database migrations
    • Adds the app.plugins_dir application object to reference the installed plugins directory

    2 details in Everything

39. 2.4.0 May 5, 2020 · release notes

    CTFd 2.4.0 adds bulk admin actions, JS/Jinja enum classes, and admin panel improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.4.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.4.0

    • python manage.py build jsenums command to generate JavaScript constants accessible via the JSEnum class
    • JinjaEnum class to inject constants into the Jinja environment for theme access
    • Bulk selection and deletion capabilities for Users, Teams, Scoreboard, Challenges, and Submissions in the Admin Panel

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Replaced flask_restplus with flask_restx dependency
    • !Removed datafreeze, normality, and banal dependencies in favor of in-repo solutions
    • !Deprecated .spinner-error CSS class
    • !Changed user role checking from accessing the type variable to using is_admin() function
40. 2.3.3 Apr 12, 2020 · release notes

    CTFd 2.3.3 improves API behavior and performance with significant changes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.3.3 https://github.com/CTFd/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.3.3

    • POST /api/v1/unlocks enforces unique unlocks, rejecting duplicates
    • Re-enable Jinja LRU Cache for significant speedups returning HTML content

    2 details in Everything

41. 2.3.2 Mar 15, 2020 · release notes

    CTFd 2.3.2 adds admin-only statistics endpoint, auto-resolves team_id for awards API, and MLC registration visibility setting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.3.2 https://github.com/CTFd/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.3.2

    └──▷ TRY IT
    Prevent non-admin users from accessing user statistics via the API.
    copy

    $ GET /api/v1/statistics/users
    # Now requires admin session token

    Award a user without knowing their team ID; CTFd resolves it automatically.
    shell copy

    curl -X POST /api/v1/awards \
      -H "Content-Type: application/json" \
      -H "Authorization: Bearer <admin_token>" \
      -d '{
        "name": "first blood",
        "value": 100,
        "category": "challenge",
        "user_id": 42
      }'

    Allow MLC (Multi-Level Clearance) registration even if general site registration is disabled.
    📍# In Admin Panel › Settings › Registration # Enable MLC Registration while leaving Site Registration disabled
    • Sets /api/v1/statistics/users route to be admins_only
    • Adds automatic team ID lookup when POSTing to /api/v1/awards without specifying team_id
    • Adds a setting to registration visibility to allow for MLC registration while registration is disabled

    3 details in Everything

42. 2.3.0 Feb 17, 2020 · release notes

    CTFd 2.3.0 adds HTML header/footer injection, email templating, and manage.py config commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.3.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.3.0

    └──▷ TRY IT
    Inject custom HTML into the site header for admins via CLI.
    copy

    $ python manage.py set_config theme_header '<script src="/custom.js"></script>'

    Retrieve the current theme configuration via CLI.
    copy

    $ python manage.py get_config ctf_theme

    • Admins can inject HTML into page headers and footers via new theme_header and theme_footer configuration keys, replacing the previous custom CSS feature.
    • Admins can now customize outgoing email content and inject variables using the new email templating capability.
    • manage.py now supports get_config and set_config subcommands for directly manipulating the CTFd Configs table.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The views.custom_css route has been removed; themes must reference theme_header and theme_footer config keys instead.
43. 2.2.2 Jan 10, 2020 · release notes

    CTFd 2.2.2 exposes jQuery, Moment, nunjucks, and Howl to window globals for plugins

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.2.2 https://github.com/CTFd/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.2.2

    └──▷ USE IT
    Use the exposed Moment library in a CTFd plugin to format challenge start times.
    javascript copy

    var formatted = window.Moment.utc(challengeDate).local().format('YYYY-MM-DD HH:mm:ss');

    • Adds window.jQuery, window.Moment, window.nunjucks, and window.Howl global variables to enable plugin access to JS modules

    1 detail in Everything

44. 2.2.0 Dec 23, 2019 · release notes

    CTFd 2.2.0 adds configurable notification delivery modes, SERVER_SENT_EVENTS config key, API access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., and endpoint args for plugin asset registration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.2.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.2.0

    • SERVER_SENT_EVENTS config value added to control whether server-sent notifications are enabled
    • Access tokens functionality for API usage
    • Team size limits can now be enforced from the configuration panel
    • Admins can choose how to deliver their notifications (Toast, Alert, Background, Sound On/Off)
    • API endpoint DELETE /api/v1/teams/[team_id]/members now cascades deletion of Submissions, Awards, and Unlocks

    +2 more show less

    • register_plugin_assets_directory() and register_plugin_asset() add an endpoint parameter to control the Flask route for plugin assets
    • CTFd.utils.email.sendmail() now accepts a subject argument with custom variable injection via safe_format()

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !If you are using a custom theme or plugin with JavaScript, it will likely break and require an upgrade to work with v2.2.0.
    • !Switching Docker base image from python:2.7-alpine to python:3.7-alpine.
45. 2.1.4 Aug 31, 2019 · release notes

    CTFd v2.1.4 adds admin IP search and Users.get_place() returns None for unranked users

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.1.4 https://github.com/CTFd/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.1.4

    └──▷ TRY IT
    Verify unranked users correctly return a falsy None value in admin scripts.
    copy

    $ python -c "from CTFd.models import Users; u = Users.query.first(); print(u.get_place())"

    Handle 403 responses for team profile API calls when users are not captains.
    shell copy

    curl -s https://ctf.example.com/api/v1/teams/me | jq '.code == 403'

    • Add search_by_ip capability to the admin user lookup interface
    • Users.get_place() and Teams.get_place() return None instead of 0 when an account has no rank/place

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Users.get_place() and Teams.get_place() methods now return None instead of 0 for unranked accounts, potentially breaking code that expects an integer.
    • !The team profile endpoint (/api/v1/teams/me) will now return 403 instead of 400 if the requesting user is not the captain.
46. 2.1.3 Jun 22, 2019 · release notes

    CTFd 2.1.3 adds account metadata to scoreboard API and new admin UI for team management

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.1.3 https://github.com/CTFd/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.1.3

    └──▷ USE IT
    Retrieve scoreboard data with account URLs for direct linking to user profiles instead of generic entries.
    shell copy

    curl -s https://ctfd.example.com/api/v1/scoreboard | jq '.data[].account_url'

    • Adds account_type and account_url fields to the /api/v1/scoreboard endpoint response

    1 detail in Everything

47. 2.1.1 May 4, 2019 · release notes

    CTFd 2.1.1 adds admin challenge preview without team membership and cascade delete support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.1.1 https://github.com/CTFd/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.1.1

    └──▷ TRY IT
    Test challenge configuration and preview without manually creating a test user/team.
    copy

    $ curl -H "Authorization: Bearer <admin_token>" http://<ctfd_host>/api/v1/challenges

    • Allows admins to hit /api/v1/challenges and /api/v1/challenges/[id] without having a team
    • Adds ondelete='CASCADE' to most ForeignKeys in models allowing for deletions to remove associated data

    2 details in Everything

48. 2.1.0 Apr 26, 2019 · release notes

    CTFd 2.1.0 adds team captains, token-based file downloads, real-time SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. notifications, and a /api/v1/teams/[team_id]/members endpoint.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.1.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.1.0

    • Challenge file downloads now accept a ?token= parameter for external tool access
    • Adds Server-Side Events real-time notifications for authenticated users at the /events endpoint
    • Introduces the Team Captain role, allowing captains to edit team name, password, and website
    • Caches /api/v1/scoreboard and /api/v1/scoreboard/top/[count] endpoints

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Flask-SocketIO dependency removed; SOCKETIO_ASYNC_MODE config key deleted, requiring gevent worker for real-time support
    • !Challenge file access now requires a valid auth token via ?token= parameter; unauthenticated direct downloads are blocked
49. 2.0.4 Jan 31, 2019 · release notes

    Adds email domain whitelisting, get_config defaults, and gunicorn log env vars in CTFd 2.0.4.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0.4 https://github.com/CTFd/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.0.4

    └──▷ TRY IT
    Allow admins to retrieve config values with a fallback if the key is not set in the database.
    copy

    $ get_config('smtp_host', default='mail.ctfd.io')

    • email.check_email_is_whitelisted() enforces domain whitelist for user email changes
    • get_config wrapper accepts a default parameter to return fallback values
    • utils.get_app_config() adds a default argument and removes memoization

    3 details in Everything

50. 2.0.2 Jan 4, 2019 · release notes

    CTFd 2.0.2 adds notifications API endpoint, account_url field to solves, and plugin JS/CSS registration for admin panel

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0.2 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.0.2

    • Adds GET /api/v1/notifications/<id> endpoint to retrieve individual notifications by ID (currently public)
    • Adds account_url JSON field to /api/v1/<challenge_id>/solves responses for account location data
    • Adds plugin utilities to register JavaScript and CSS files specifically for the admin panel

    3 details in Everything

51. 2.0.0 Dec 2, 2018 · release notes

    CTFd 2.0 introduces team mode, MLC OAuth, dynamic challenges, S3 uploads, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. UI data, real-time notifications, domain whitelisting, CSV export, session cache, challenge requirements, admin reset, server-side sessions, and plugin loading control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 2.0.0

    └──▷ USE IT
    Configure CTFd to store sessions in Redis for revocation capabilities
    config copy

    SESSION_TYPE = 'redis'

    Disable all plugins for a secure, standalone cyber tool environment
    config copy

    SAFE_MODE = True

    Use the front-end fetch API to retrieve user data dynamically instead of relying on server-side templates
    code copy

    fetch('/api/v1/users').then(r => r.json())

    • User Mode and Team Mode separation replaces the previous single-user model to allow individual play or team collaboration in a cyber tool
    • Integration with MajorLeagueCyber (MLC) allows event organizers to set OAuth Client ID & Client Secret for automatic user registration via the REST API
    • Front-end now consumes all data via the REST API using fetch() instead of server-side rendering
    • Dynamic Challenges are built-in, enabling challenges with adjustable scoring or hints
    • S3-backed uploading/downloading is built in for challenge attachments and files

    +8 more show less

    • Real time notifications/announcements use long-polling via socket.io to simplify deployment without requiring websockets
    • Database exporting to CSV functionality added for user data export
    • Reset CTF from the config panel removes all users, solves, and fails while retaining challenge data
    • Countries are now pre-determined and selectable by country code instead of being user-entered text
    • Sessions are stored server-side in a cache (filesystem or redis) via CTFd/config.py, allowing for session revocation
    • Challenges can now have requirements which must be met before the challenge can be seen/solved."
    • Dockerfile improvements include WORKERS count defaulting to 1 and docker-entrypoint.sh exiting on any error
    • Create SAFE_MODE configuration in config file to disable loading of plugins

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Migrating from version 1.2.0 requires running the migrations/1_2_0_upgrade_2_0_0.py script; many unofficial plugins will not be supported without updates.
    • !ctf_name() in themes is renamed to get_ctf_name()
    • !ctf_logo() in themes is renamed to get_ctf_logo()
    • !ctf_theme() in themes is renamed to get_ctf_theme()
    • !Workshop mode, score hiding, registration hiding, and challenge hiding visibility settings are changed to functions: accounts_visible(), challenges_visible(), registration_visible(), scores_visible()
52. 1.2.0 May 4, 2018 · release notes

    CTFd 1.2.0 introduces case-insensitive flags, admin challenge solver visibility, and API endpoint separation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.2.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 1.2.0

    • ezpg() JS function introduced to display progressbar modals
    • $.patch() AJAX wrapper added for client-side requests
    • /chals endpoint now returns only list; details moved to /chals/:id
    • Admin panel shows which users solved specific challenges
    • Config panel allows uploading a CTF logo

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Challenge type plugins that override the markdown renderer are broken because marked was replaced by Markdown-It
53. 1.1.3 Mar 27, 2018 · release notes

    CTFd 1.1.3 adds CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session.-exempt route decorator and improved Docker support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.3 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 1.1.3

    └──▷ HOW TO FIND IT
    Scale the application's concurrency in your Docker environment to handle more simultaneous connections.
    📍# In docker-compose.yml under the web service # environment: # - WORKERS=4
    • Adds csrf_exempt utility decorator to allow routes to forego CSRF protection
    • Enables configurable number of gevent workers via Docker Compose

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The static_html handler for accessing raw HTML files has been removed; Pages is now the only supported means to access or create content.
54. 1.1.1 Jan 8, 2018 · release notes

    CTFd 1.1.1 adds challenge preview details and fixes JS callback interface

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.1 https://github.com/CTFd/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 1.1.1

    └──▷ USE IT
    Use the new update() callback for async theme updates.
    javascript copy

    update(data, function() { console.log('Updated'); });

    Ensure script_root is available in Nunjucks templates for correct file paths.
    html copy

    {{ script_root }}

    • Adds tags, hints, and files to challenge previews displayed in the editor.
    • Changes the JavaScript update() function to accept a callback argument instead of using hardcoded logic.
    • Updates chalboard.js to pass script_root into Nunjucks templates, enabling file downloads under subdirectories.

    3 details in Everything

55. 1.1.0 Dec 22, 2017 · release notes

    CTFd 1.1.0 introduces paused CTFs, challenge previews, draft pages, and app_config utility

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 1.1.0

    └──▷ USE IT
    Access app-level configuration values securely within custom plugin code.
    python copy

    from CTFd.utils import get_app_config
    config_val = get_app_config('SOME_KEY')

    Restrict a custom admin-only page to authenticated users only using the new decorator.
    python copy

    from CTFd.utils.decorators import authed_only
    @app.route('/admin/special', methods=['GET'])
    @authed_only
    def special_admin_view():
        return render_template('special.html')

    • ctf.paused flag added to pause competitions and prevent new solves.
    • Challenge preview feature added to admin panel (/admin/challenges/<id>/preview or via UI).
    • Hint preview feature added to admin panel for hint content review.
    • Pages can now be set as drafts, invisible to regular users.
    • Pages can now require authentication to view.

    +2 more show less

    • utils.get_app_config() function added to access app.config values (replaces old behavior of utils.get_config()).
    • New authed_only decorator available to restrict page access to logged-in users.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Keys.key_type column renamed to Keys.type in the database schema.
    • !Challenge Type Plugins must now use Nunjucks instead of Handlebars.
56. 1.0.5 Oct 25, 2017 · release notes

    CTFd v1.0.5 adds plugin asset serving, admin/user menu registration, and a /team profile endpoint

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.5 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 1.0.5

    • CTFd.plugins.register_plugin_assets_directory allows plugins to register directories to be served.
    • CTFd.plugins.register_plugin_asset allows plugins to register individual files to be served.
    • CTFd.plugins.register_admin_plugin_menu_bar allows plugins to add entries to the admin menu bar.
    • CTFd.plugins.register_user_page_menu_bar allows plugins to add entries to the user menu bar.
    • A new /team endpoint serves the user's own public profile.

    5 details in Everything

57. 1.0.4 Sep 13, 2017 · release notes

    Adds plugin registration for global JS/CSS and challenge input control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.4 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 1.0.4

    • Adds utils.register_plugin_script() for plugins to register global JS files
    • Adds utils.register_plugin_stylesheet() for plugins to register global CSS files
    • Challenge type plugins can now control the response to a user's input

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Containers functionality has been moved out of core and into a separate plugin (CTFd-Docker)
58. 1.0.3 Jul 1, 2017 · release notes

    CTFd v1.0.3 adds admin team search, theme switching without restart, plugin template overrides via override_template(), and Markdown page support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.3 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 1.0.3

    • Adds override_template() function allowing plugins to replace the content of any template loaded by CTFd
    • Admins can now search for teams in the admin panel
    • Theme switching no longer requires a server restart
    • Pages feature now supports Markdown and the Pages editor has a preview button

    4 details in Everything

59. 1.0.2 Apr 30, 2017 · release notes

    CTFd v1.0.2 adds per-challenge max attempts, hints, admin auto-login on setup, and data export/import via zip.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.2 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 1.0.2

    • Adds max_attempts setting to individual challenges to limit user submissions
    • Introduces Hints feature allowing authors to add clues to challenges
    • Setup workflow automatically logs in the initial user as admin after configuration
    • Enables plugins to replace core utility functions used by CTFd
    • Allows customization of challenge editing modals within the admin panel

    +1 more show less

    • Adds ability to export and import CTF data as zip files for redeployment

    6 details in Everything

60. 1.0.1 Mar 8, 2017 · release notes

    CTFd 1.0.1 introduces plugin-modifiable challenge and flag types with plugin configuration pages

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.1 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 1.0.1

    • Supports multiple kinds of challenges via plugin-modifiable challenge types
    • Supports multiple kinds of flags/keys via plugin-modifiable solve logic
    • Allows plugins to define their own configuration page

    3 details in Everything

61. 1.0.0 Jan 25, 2017 · release notes

    First release of CTFd service with browser management, theme/plugin support, container execution, and database migrations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.0 https://github.com/isislab/CTFd.git
    # already have the repo? check out this version:
    $ git checkout 1.0.0

    • Adds browser-based management interface for all CTF operational aspects
    • Enables running containers directly from the CTFd service via new run containers capability
    • Introduces plugin system for customizing CTFd's core functionality
    • Adds theme support for customizing the look and feel of the CTFd interface
    • Includes initial database migrations schema for future modifications and automatic updates

    5 details in Everything