CVE-2024-11037

A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systems by accessing a specific URL that includes the absolute path of the project.
References
Link Resource
https://huntr.com/bounties/91243fc1-f287-4f4b-8aa6-dfe3efff23e5 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:binary-husky:gpt_academic:2024-10-10:*:*:*:*:*:*:*

History

31 Jul 2025, 14:51

Type Values Removed Values Added
CPE cpe:2.3:a:binary-husky:gpt_academic:2024-10-10:*:*:*:*:*:*:*
Summary
  • (es) Existe una vulnerabilidad de path traversal en binary-husky/gpt_academic, en el commit 679352d, que permite a un atacante eludir la protección de las rutas bloqueadas y leer el archivo config.py que contiene información confidencial, como la clave de la API de OpenAI. Esta vulnerabilidad se puede explotar en sistemas operativos Windows accediendo a una URL específica que incluye la ruta absoluta del proyecto.
First Time Binary-husky gpt Academic
Binary-husky
References () https://huntr.com/bounties/91243fc1-f287-4f4b-8aa6-dfe3efff23e5 - () https://huntr.com/bounties/91243fc1-f287-4f4b-8aa6-dfe3efff23e5 - Exploit, Third Party Advisory

20 Mar 2025, 10:15

Type Values Removed Values Added
New CVE

Information

Published : 2025-03-20 10:15

Updated : 2025-07-31 14:51


NVD link : CVE-2024-11037

Mitre link : CVE-2024-11037

CVE.ORG link : CVE-2024-11037


JSON object : View

Products Affected

binary-husky

  • gpt_academic
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')