← Back

CVE-2024-12389

nvd nist
Published: Mar 20, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: security@huntr.dev (Secondary)

Description

A path traversal vulnerability exists in binary-husky/gpt_academic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will remain within the intended extraction directory. An attacker can exploit this vulnerability to perform arbitrary file writes, which can lead to remote code execution.

Affected (1)

Binary Husky
1 product
Gpt Academic
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Gpt Academic
Version 2024-10-15

Related CWEs

CWE-29
Path Traversal: '\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

References (1)

Source: security@huntr.dev
ExploitThird Party Advisory

Timeline

No history available yet.