Eggdkk

**Name of the Vulnerable Software and Affected Versions** gpt academic versions 3.37 and prior **Description** A vulnerability was found in the Configuration File Handler component of gpt academic, affecting the processing of certain files. The manipulation of the `file` argument leads to information disclosure, allowing sensitive information files in working directories to be read through the "/file" route. This issue affects users who configure the project via `config.py`, `config private.py`, or `Dockerfile` files. **Recommendations** For gpt academic versions 3.37 and prior, update to a version that includes the patch available at commit 1dcc2873d2168ad2d3d70afcb453ac1695fbdf02. As a temporary workaround, consider using environment variables instead of `config*.py` files to configure the project. Alternatively, use docker-compose installation to configure the project, avoiding the use of sensitive files in the working directories.

**Name of the Vulnerable Software and Affected Versions** Gin-vue-admin versions prior to 2.5.4 **Description** The issue concerns an arbitrary file read due to insufficient validation of the `fileMd5` and `fileName` parameters in the file upload functionality. This allows unauthorized access to files. The problem is resolved in version 2.5.4b. **Recommendations** For versions prior to 2.5.4, update to version 2.5.4b to resolve the issue. As a temporary workaround, consider disabling the file upload feature until the update is applied. Restrict access to sensitive files and directories to minimize the risk of exploitation.