PT-2025-12130 · Unknown · Binary-Husky/Gpt Academic

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-12387

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions binary-husky/gpt academic versions as of commit git 3890467

Description A vulnerability in the binary-husky/gpt academic repository allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the uploaded file and attempts to load it into memory, which can lead to an out-of-memory crash. This issue arises due to improper input validation when handling compressed file uploads.

Recommendations As a temporary workaround, consider disabling the compressed file upload feature until a patch is available. Restrict access to the server to minimize the risk of exploitation. Avoid using the zip file type in uploads until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-409

CWE-20

Related Identifiers

CVE-2024-12387

Affected Products

Binary-Husky/Gpt Academic

References · 5

• 🔥 https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12387 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12387 · Vendor Advisory
• https://t.me/cvenotify/115464 · Telegram Post
• https://twitter.com/CVEnew/status/1902670988304613858 · Twitter Post