CVE-2024-10100 Path Traversal in binary-husky/gpt_academic

What is CVE-2024-10100?

CVE-2024-10100 is a medium-severity path traversal vulnerability in binary-husky/gpt_academic, published on 17 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file parameter, which is open to path traversal through URL encoding. This allows attackers to view any file on the host system, including sensitive files such as critical application files, SSH keys, API keys, and configuration values.

Weakness: CWE-22

Which versions are affected by CVE-2024-10100?

It affects 1 product.

Products include Binary-Husky Gpt Academic.

How do I fix CVE-2024-10100?

No fix has been published for CVE-2024-10100 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-10100 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-10100 exists.

Other vulnerabilities in binary-husky/gpt_academic

• CVE-2026-0763 GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability Critical 9.8
• CVE-2026-0764 GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability Critical 9.8
• CVE-2024-31224 GPT Academic: Pickle deserializing cookies may pose RCE risk Critical 9.8
• CVE-2024-10950 Code Injection in binary-husky/gpt_academic High 8.8
• CVE-2024-10954 Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim` High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hxww-jp5h-xqpc.