Path Traversal Vulnerability in Binary-Husky GPT Academic Software

CVE-2024-12389

What is CVE-2024-12389?

A path traversal vulnerability has been identified in Binary-Husky's GPT Academic software, specifically in version git 310122f. This flaw arises due to the application’s inadequate validation when extracting user-provided 7z files. The underlying py7zr package does not sufficiently restrict the files to the designated extraction directory, leading to potential arbitrary file writes. If exploited, attackers could leverage this vulnerability to execute remote code, posing significant security threats.

References