Local File Read Vulnerability in GPT Academic Software by GPT

CVE-2024-10986

What is CVE-2024-10986?

The GPT Academic software version 3.83 contains a vulnerability through its HotReload function, which allows the downloading and extraction of tar.gz files from arxiv.org. While the application has protections against path traversal, it fails to mitigate risks associated with symlinks, enabling attackers to access arbitrary local files on the server. This serious oversight could lead to unauthorized access to sensitive information stored on the affected systems.

References