CVE-2024-10100

Published: Oct 17, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file parameter, which is open to path traversal through URL encoding. This allows attackers to view any file on the host system, including sensitive files such as critical application files, SSH keys, API keys, and configuration values.

Affected (1)

Products: Binary Husky: Gpt Academic

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Binary Husky Gpt Academic	Version 3.83

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (1)

https://huntr.com/bounties/e58a0fb4-2b1d-49ef-b32e-bb62659a6f99

Source: security@huntr.dev

ExploitThird Party Advisory

Timeline

No history available yet.