PT-2025-12091 · Unknown · Binary-Husky/Gpt Academic

Published 2025-03-20 · Updated 2025-03-22 · CVE-2024-11037

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic at commit 679352d

Description A path traversal issue exists, allowing an attacker to bypass the blocked paths protection and read sensitive information, such as the OpenAI API key, from the config.py file. This issue can be exploited on Windows operating systems by accessing a specific URL that includes the absolute path of the project.

Recommendations For binary-husky/gpt academic at commit 679352d, consider restricting access to the blocked paths feature until a patch is available to prevent path traversal attacks. As a temporary workaround, avoid using absolute paths in project URLs to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-11037

Affected Products

Binary-Husky/Gpt Academic

References · 5

• 🔥 https://huntr.com/bounties/91243fc1-f287-4f4b-8aa6-dfe3efff23e5 · Exploit
• https://osv.dev/vulnerability/CVE-2024-11037 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11037 · Security Note
• https://twitter.com/CVEnew/status/1903336834173726951 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1902677105344762298 · Twitter Post