CVE-2024-10986: GPT Academic version 3.83 is vulnerable to a Local File Read (LFI) vulnerability through its HotReload function. This function can download and extract tar.gz…

PriorityP352high8.8CVSS 3.0

AVNACLPRLUINSUCHIHAH

EPSS

0.75%

50.4th percentile

GPT Academic version 3.83 is vulnerable to a Local File Read (LFI) vulnerability through its HotReload function. This function can download and extract tar.gz files from arxiv.org. Despite implementing protections against path traversal, the application overlooks the Tarslip triggered by symlinks. This oversight allows attackers to read arbitrary local files from the victim server.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
binary-husky	binary-husky_gpt_academic	unspecified – latest	—
binary-husky	gpt_academic	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.