VulnerabilityAnalyzed

CVE-2024-10100

A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83.

HIGH 7.5EPSS 0.62%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file parameter, which is open to path traversal through URL encoding. This allows attackers to view any file on the host system, including sensitive files such as critical application files, SSH keys, API keys, and configuration values.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.62% probability · 48th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: binary-husky/gpt academic
Source: security@huntr.dev

References

https://huntr.com/bounties/e58a0fb4-2b1d-49ef-b32e-bb62659a6f99Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.