Description
A vulnerability has been found in binary-husky gpt_academic up to 3.91. Impacted is the function merge_tex_files_ of the file crazy_functions/latex_fns/latex_toolbox.py of the component LaTeX File Handler. Such manipulation of the argument \input{} leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Es wurde eine Schwachstelle in binary-husky gpt_academic bis 3.91 entdeckt. Betroffen hiervon ist die Funktion merge_tex_files_ der Datei crazy_functions/latex_fns/latex_toolbox.py der Komponente LaTeX File Handler. Durch das Manipulieren des Arguments \input{} mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Angriff kann remote ausgeführt werden. Der Exploit steht zur öffentlichen Verfügung.
Problem types
Product status
3.1
3.2
3.3
3.4
3.5
3.6
3.7
3.8
3.9
3.10
3.11
3.12
3.13
3.14
3.15
3.16
3.17
3.18
3.19
3.20
3.21
3.22
3.23
3.24
3.25
3.26
3.27
3.28
3.29
3.30
3.31
3.32
3.33
3.34
3.35
3.36
3.37
3.38
3.39
3.40
3.41
3.42
3.43
3.44
3.45
3.46
3.47
3.48
3.49
3.50
3.51
3.52
3.53
3.54
3.55
3.56
3.57
3.58
3.59
3.60
3.61
3.62
3.63
3.64
3.65
3.66
3.67
3.68
3.69
3.70
3.71
3.72
3.73
3.74
3.75
3.76
3.77
3.78
3.79
3.80
3.81
3.82
3.83
3.84
3.85
3.86
3.87
3.88
3.89
3.90
3.91
Timeline
| 2025-09-10: | Advisory disclosed |
| 2025-09-10: | VulDB entry created |
| 2025-09-10: | VulDB entry last update |
Credits
d3do (VulDB User)
References
vuldb.com/?id.323505 (VDB-323505 | binary-husky gpt_academic LaTeX File latex_toolbox.py merge_tex_files_ path traversal)
vuldb.com/?ctiid.323505 (VDB-323505 | CTI Indicators (IOB, IOC, TTP, IOA))
vuldb.com/?submit.640977 (Submit #640977 | gpt_academic latest Absolute Path Traversal)
github.com/.../cvelist/blob/main/gpt_academic/Plugins_LFI.md
