CVE-2025-55149 Path Traversal Vulnerability in PDF Review Function (CWE-22)
Attackers can read arbitrary PDF files on the server via path traversal in the review function, exposing sensitive documents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-55149?
CVE-2025-55149 is a medium-severity path traversal vulnerability in ulab-uiuc tiny-scientist, published on 9 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tiny-Scientist is a lightweight framework for automating the entire lifecycle of scientific research—from ideation to implementation, writing, and review. In versions 0.1.1 and below, a critical path traversal vulnerability has been identified in the review_paper function in backend/app.py. The vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass the intended security restrictions. This vulnerability allows attackers to: read any PDF file accessible to the server process, potentially access sensitive documents outside the intended directory and perform reconnaissance on the server's file system structure. This issue does not currently have a fix.
Weakness: CWE-22
Which versions are affected by CVE-2025-55149?
3 open source packages ship an affected version, including tiny-scientist.
| Package | Affected | Fixed in |
|---|---|---|
tiny-scientist PyPI | All versions to 1.1.0 | None |
tiny-scientist PyPI | All versions to 1.1.0 | None |
tiny-scientist PyPI | All versions to 1.1.0 | None |
How do I fix CVE-2025-55149?
No fix has been published for CVE-2025-55149 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-55149 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-55149 exists.
Sources
Also known as GHSA-rrgf-hcr9-jq6h, PYSEC-2026-1967.