PT-2025-12087 · Unknown · Gpt Academic

Published 2025-03-20 · Updated 2025-07-14 · CVE-2024-10986

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GPT Academic version 3.83

Description The issue concerns a Local File Read (LFI) vulnerability through the HotReload function, which can download and extract tar.gz files from arxiv.org. Despite protections against path traversal, the application is vulnerable due to its handling of symlinks, specifically the Tarslip triggered by them, allowing attackers to read arbitrary local files from the victim server.

Recommendations For GPT Academic version 3.83, as a temporary workaround, consider disabling the HotReload function until a patch is available. Restrict access to the HotReload function to minimize the risk of exploitation. Avoid using the HotReload function to download and extract tar.gz files from untrusted sources until the issue is resolved.

Exploit

Fix

Link Following

RCE

Weakness Enumeration

CWE-59

CWE-20

Related Identifiers

CVE-2024-10986

Affected Products

Gpt Academic

References · 6

• 🔥 https://huntr.com/bounties/db2167f5-f17f-491d-aeec-69ba55bf6427 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-10986 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10986 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902671054193283496 · Twitter Post
• https://t.me/cvenotify/128870 · Telegram Post
• https://twitter.com/cybercronai/status/1903095642270191995 · Twitter Post