PT-2025-9508 · Unknown · Gpt Academic

Startr4Ck · Published 2025-03-03 · Updated 2025-03-04 · CVE-2025-25185

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GPT Academic versions 3.91 and earlier

Description The issue arises from the improper handling of soft links in GPT Academic. An attacker can exploit this by creating a malicious soft link file, packaging it into a tar.gz file, and uploading it to the server. When the file is decompressed and accessed, the soft link points to a target file on the victim server, allowing attackers to read all files on the server.

Recommendations For versions 3.91 and earlier, update to a version that properly accounts for soft links to resolve the issue. As a temporary workaround, consider restricting access to the file upload feature to minimize the risk of exploitation. Avoid using the file upload feature with untrusted sources until the issue is resolved.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2025-25185

GHSA-GQP5-WM97-QXCV

Affected Products

Gpt Academic

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25185.json · Exploit
• https://github.com/binary-husky/gpt_academic/commit/5dffe8627f681d7006cebcba27def038bb691949 · Patch
• https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-gqp5-wm97-qxcv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25185 · Security Note
• https://twitter.com/VulmonFeeds/status/1896619903638978887 · Twitter Post
• https://twitter.com/CVEnew/status/1896767619228729565 · Twitter Post