PT-2025-12089 · Unknown+2 · Binary-Husky/Gpt Academic+2

Published 2025-03-20 · Updated 2025-07-15 · CVE-2024-11031

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic version 3.83

Description A Server-Side Request Forgery (SSRF) issue exists in the Markdown Translate.get files from everything() API, allowing attackers to download arbitrary web hosts by exploiting the HotReload plugin function. This function only checks if the link starts with 'http', enabling abuse of the victim GPT Academic's Gradio Web server credentials to access unauthorized web resources.

Recommendations For version 3.83, consider disabling the HotReload plugin function or restricting its use to prevent exploitation until a patch is available. Additionally, restrict access to the Markdown Translate.get files from everything() API to minimize the risk of unauthorized web resource access.

Exploit

Fix

Information Disclosure

SSRF

Weakness Enumeration

CWE-200

CWE-918

Related Identifiers

CVE-2024-11031

Affected Products

Gradio

Hotreload

Binary-Husky/Gpt Academic

References · 7

• 🔥 https://huntr.com/bounties/d27d89a7-7d54-45b9-a9eb-66c00bc56e02 · Exploit
• https://osv.dev/vulnerability/CVE-2024-11031 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11031 · Security Note
• https://t.me/cvenotify/128886 · Telegram Post
• https://t.me/cvenotify/128974 · Telegram Post
• https://twitter.com/CVEnew/status/1903016832358858911 · Twitter Post
• https://twitter.com/cybercronai/status/1903103211646619852 · Twitter Post