PT-2025-32426 · Unknown · Tiny-Scientist

Ruizhe · Published 2025-08-09 · Updated 2025-08-11 · CVE-2025-55149

Positive Technologies (AI Summary)

CVSS v4.0

6.7

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Tiny-Scientist versions 0.1.1 and below

Description Tiny-Scientist is a lightweight framework for automating the entire lifecycle of scientific research. A path traversal vulnerability has been identified in the review paper function in backend/app.py. This allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass security restrictions. Attackers can read any PDF file accessible to the server process, potentially accessing sensitive documents and performing reconnaissance on the server's file system structure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-55149

GHSA-RRGF-HCR9-JQ6H

Affected Products

Tiny-Scientist

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55149.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55149 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55149 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rrgf-hcr9-jq6h · Vendor Advisory
• https://github.com/ulab-uiuc/tiny-scientist/security/advisories/GHSA-rrgf-hcr9-jq6h · Note
• https://github.com/ulab-uiuc/tiny-scientist · Note
• https://github.com/ulab-uiuc/tiny-scientist/commit/7fd42873603012acb8c55a4fc3eaac9ab18e6559 · Note
• https://twitter.com/VulmonFeeds/status/1954048975616524726 · Twitter Post
• https://t.me/CVEtracker/29573 · Telegram Post
• https://twitter.com/f8sbrightermind/status/1954044698349211775 · Twitter Post
• https://twitter.com/CVEnew/status/1954014366145425740 · Twitter Post