Vulnerability in Binary-Husky Binary-Husky/gpt Academic
CVE-2024-10986
GPT Academic version 3.83 is vulnerable to a Local File Read (LFI) vulnerability through its HotReload function. This function can download and extract tar.gz files from arxiv.org. Despite implementing protections against path traversal, the application overlooks the Tarslip triggered by symlinks. This oversight allows attackers to read arbitrary local files from the victim server.
EPSS: 0.008 (51.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Binary-husky Binary-husky/gpt_academic — versions unspecified
- Binary-husky Gpt_academic — versions 3.83
Weakness classification (CWE)
References
- security@huntr.dev (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-10986?
- CVE-2024-10986 is a high-severity vulnerability in Binary-Husky Binary-Husky/gpt Academic, classified under Improper Link Resolution Before File Access. CVSS score: 8.8/10. Published 2025-03-20.
- How severe is CVE-2024-10986?
- High severity. CVSS v3 base score is 8.8 out of 10.