CVE-2024-10986

NONE EPSS 50.4%

Published Mar 20, 20251y ago · Modified Jun 17, 20261w ago

Published Mar 20, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

GPT Academic version 3.83 is vulnerable to a Local File Read (LFI) vulnerability through its HotReload function. This function can download and extract tar.gz files from arxiv.org. Despite implementing protections against path traversal, the application overlooks the Tarslip triggered by symlinks. This oversight allows attackers to read arbitrary local files from the victim server.

Threat Intelligence

EPSS Exploit Probability

50.4% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-59

Affected Products 1

Vendor	Product	Version	Range
binary-husky	gpt_academic	3.83	any

References 1

huntr.com https://huntr.com/bounties/db2167f5-f17f-491d-aeec-69ba55bf6427

ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.