PT-2025-12082 · Unknown · Binary-Husky/Gpt Academic

Published 2025-03-20 · Updated 2025-07-29 · CVE-2024-10948

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic (affected versions not specified)

Description A vulnerability in the upload function allows any user to read arbitrary files on the system, including sensitive files such as config.py. An attacker can exploit this issue by intercepting the websocket request during file upload and replacing the file path with the path of the file they wish to read. The server then copies the file to the private upload folder and provides the path to the copied file, which can be accessed via a GET request. This can lead to the exposure of sensitive system files, potentially including credentials, configuration files, or sensitive user data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-10948

Affected Products

Binary-Husky/Gpt Academic

References · 5

• 🔥 https://huntr.com/bounties/290a379d-8441-4292-a553-3587e8c5c729 · Exploit
• https://osv.dev/vulnerability/CVE-2024-10948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10948 · Security Note
• https://t.me/cveNotify/130144 · Telegram Post
• https://twitter.com/CVEnew/status/1902671019841855574 · Twitter Post