CVE-2024-10986 json
Local File Read (LFI) by Tarslip Symlink via arxiv_download() API in binary-husky/gpt_academic
published 2025-03-20 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-7061
- cvss
- 8.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
GPT Academic version 3.83 is vulnerable to a Local File Read (LFI) vulnerability through its HotReload function. This function can download and extract tar.gz files from arxiv.org. Despite implementing protections against path traversal, the application overlooks the Tarslip triggered by symlinks. This oversight allows attackers to read arbitrary local files from the victim server.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
0.83% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/db2167f5-f17f-491d-aeec-69ba55bf6427 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- binary-husky binary-husky/gpt_academic
Classification
- Weakness
-
- CWE-59 Improper Link Resolution Before File Access
References
-
huntr.com
/bounties/db2167f5-f17f-491d-aeec-69ba55bf6427
exploit, third-party-advisory
Sources
- CVE List CVE-2024-10986
- NVD CVE-2024-10986
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.