Path Traversal Vulnerability in Tiny-Scientist Framework

CVE-2025-55149

What is CVE-2025-55149?

Tiny-Scientist is a lightweight framework designed for automating the entire lifecycle of scientific research. However, in versions 0.1.1 and below, a path traversal vulnerability has been discovered within the review_paper function located in backend/app.py. This flaw enables malicious actors to exploit crafted file paths to circumvent security protocols, gaining unauthorized access to arbitrary PDF files stored on the server. As a result, attackers could potentially retrieve sensitive documents and engage in reconnaissance of the server's file system, exposing critical data and undermining security measures. As of now, no patch is available for this vulnerability.

References