PT-2026-1994 · Gpt Academic+2 · Gpt Academic

Gothburz + 1 · Publicado 2026-01-09 · Atualizado 2026-02-18 · CVE-2026-0764

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GPT Academic (affected versions not specified)

Description A flaw exists that allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this issue. The vulnerability is due to insufficient validation of user-supplied data within the upload endpoint, leading to deserialization of untrusted data. An attacker can potentially execute code with root privileges. The specific API endpoint involved is the upload endpoint. The vulnerability stems from the deserialization of untrusted data, potentially through a vulnerable parameter submitted during the upload process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2026-0764

ZDI-26-030

Produtos afetados

Gpt Academic

Referências · 7

• https://twitter.com/CveFindCom/status/2014558884334043210 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-0764 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2014576957426696522 · Publicação no Twitter
• https://zerodayinitiative.com/advisories/ZDI-26-030 · Nota de Segurança
• https://t.me/cveNotify/152367 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-0764 · Nota de Segurança
• https://twitter.com/vuln_tracker/status/2014567151542403236 · Publicação no Twitter