CVE-2024-12389CWE-29

Path Traversal in binary-husky/gpt_academic

High · published March 20, 2025

CVSS v3.0
8.8
EPSS
2%
Percentile
76.4
In the wild
Unconfirmed
What it is

A path traversal vulnerability exists in binary-husky/gpt_academic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will remain within the intended extraction directory. An attacker can exploit this vulnerability to perform arbitrary file writes, which can lead to remote code execution.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01653 · 76.4th percentile
Weakness
CWE-29 · Path Traversal: '\..\filename'
Published
2025-03-20T10:10Z
EPSS history
Timeline
  • 20 MAR 10:10Z
    Path Traversal in binary-husky/gpt_academic
    cvelistv5