PT-2026-1994 · Gpt Academic+2 · Gpt Academic

Gothburz + 1 · Published 2026-01-09 · Updated 2026-02-18 · CVE-2026-0764

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GPT Academic (affected versions not specified)

Description A flaw exists that allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this issue. The vulnerability is due to insufficient validation of user-supplied data within the upload endpoint, leading to deserialization of untrusted data. An attacker can potentially execute code with root privileges. The specific API endpoint involved is the upload endpoint. The vulnerability stems from the deserialization of untrusted data, potentially through a vulnerable parameter submitted during the upload process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-0764

ZDI-26-030

Affected Products

Gpt Academic

References · 7

• https://osv.dev/vulnerability/CVE-2026-0764 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-030 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0764 · Security Note
• https://twitter.com/CveFindCom/status/2014558884334043210 · Twitter Post
• https://twitter.com/CVEnew/status/2014576957426696522 · Twitter Post
• https://t.me/cveNotify/152367 · Telegram Post
• https://twitter.com/vuln_tracker/status/2014567151542403236 · Twitter Post