PT-2025-9508 · Unknown · Gpt Academic

Startr4Ck · Publicado 2025-03-03 · Atualizado 2025-03-04 · CVE-2025-25185

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GPT Academic versions 3.91 and earlier

Description The issue arises from the improper handling of soft links in GPT Academic. An attacker can exploit this by creating a malicious soft link file, packaging it into a tar.gz file, and uploading it to the server. When the file is decompressed and accessed, the soft link points to a target file on the victim server, allowing attackers to read all files on the server.

Recommendations For versions 3.91 and earlier, update to a version that properly accounts for soft links to resolve the issue. As a temporary workaround, consider restricting access to the file upload feature to minimize the risk of exploitation. Avoid using the file upload feature with untrusted sources until the issue is resolved.

Exploit

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2025-25185

GHSA-GQP5-WM97-QXCV

Produtos afetados

Gpt Academic

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25185.json · Exploit
• https://github.com/binary-husky/gpt_academic/commit/5dffe8627f681d7006cebcba27def038bb691949 · Correção
• https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-gqp5-wm97-qxcv · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1896619903638978887 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-25185 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-25185 · Nota de Segurança
• https://twitter.com/CVEnew/status/1896767619228729565 · Publicação no Twitter