CVE-2024-12390 Remote Code Execution in binary-husky/gpt_academic

High 8.8 Published 20 Mar 2025 Updated 15 Oct 2025

Attackers can achieve remote code execution by uploading malicious RAR files containing symlinks to write sensitive files.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-12390?

CVE-2024-12390 is a high-severity path traversal vulnerability in binary-husky/gpt_academic, published on 20 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in binary-husky/gpt_academic version git 310122f allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploited to perform arbitrary file writes. This can lead to remote code execution by writing to sensitive files such as SSH keys, crontab files, or the application's own code.

Weakness: CWE-59

Which versions are affected by CVE-2024-12390?

It affects 1 product.

Products include Binary-Husky Gpt Academic.

How do I fix CVE-2024-12390?

No fix has been published for CVE-2024-12390 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-12390 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-12390 exists.

Sources

Also known as GHSA-m2g8-2vhm-m4cx.