CVE-2024-11030 SSRF in binary-husky/gpt_academic

What is CVE-2024-11030?

CVE-2024-11030 is a high-severity server-side request forgery vulnerability in binary-husky/gpt_academic, published on 20 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability through its HotReload plugin function, which calls the crazy_utils.get_files_from_everything() API without proper sanitization. This allows attackers to exploit the vulnerability to abuse the victim GPT Academic's Gradio Web server's credentials to access unauthorized web resources.

Weakness: CWE-918

Which versions are affected by CVE-2024-11030?

It affects 1 product.

Products include Binary-Husky Gpt Academic.

How do I fix CVE-2024-11030?

No fix has been published for CVE-2024-11030 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-11030 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-11030 exists.

Other vulnerabilities in binary-husky/gpt_academic

• CVE-2026-0763 GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability Critical 9.8
• CVE-2026-0764 GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability Critical 9.8
• CVE-2024-31224 GPT Academic: Pickle deserializing cookies may pose RCE risk Critical 9.8
• CVE-2024-10950 Code Injection in binary-husky/gpt_academic High 8.8
• CVE-2024-10954 Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim` High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gh22-g6w4-m562.