CTFs are generally puzzles/games, not pentests themselves, so they will deliberately use out of date or misconfigured versions of software so that they are vuln

CTFs are generally puzzles/games, not pentests themselves, so they will deliberately use out of date or misconfigured versions of software so that they are vulnerable in a known way.