CVE-2024-11037 Path Traversal in binary-husky/gpt_academic

What is CVE-2024-11037?

CVE-2024-11037 is a medium-severity path traversal vulnerability in binary-husky/gpt_academic, published on 20 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systems by accessing a specific URL that includes the absolute path of the project.

Weakness: CWE-22

Which versions are affected by CVE-2024-11037?

It affects 1 product.

Products include Binary-Husky Gpt Academic.

How do I fix CVE-2024-11037?

No fix has been published for CVE-2024-11037 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-11037 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-11037 exists.

Other vulnerabilities in binary-husky/gpt_academic

• CVE-2026-0763 GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability Critical 9.8
• CVE-2026-0764 GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability Critical 9.8
• CVE-2024-31224 GPT Academic: Pickle deserializing cookies may pose RCE risk Critical 9.8
• CVE-2024-10950 Code Injection in binary-husky/gpt_academic High 8.8
• CVE-2024-10954 Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim` High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qhfv-rxrj-6w5f.