{"id":"CVE-2024-11037","aliases":["EUVD-2025-7048","GHSA-qhfv-rxrj-6w5f"],"status":"published","title":"Path Traversal in binary-husky/gpt_academic","description":"A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systems by accessing a specific URL that includes the absolute path of the project.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01074,"percentile":0.6519,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2025-03-20T10:08:57Z","modified":"2026-10-28T02:30:29Z","products":[{"vendor":"binary-husky","product":"binary-husky/gpt_academic"},{"vendor":"binary-husky","product":"gpt_academic"}],"references":[{"url":"https://huntr.com/bounties/91243fc1-f287-4f4b-8aa6-dfe3efff23e5","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11037","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qhfv-rxrj-6w5f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11037.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-11037","title":"Path Traversal in binary-husky/gpt_academic","description":"A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systems by accessing a specific URL that includes the absolute path of the project.","status":"published","published":"2025-03-20T10:08:57.513Z","modified":"2025-03-20T19:00:18.387Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:19.965827Z"}],"euvd":[{"id":"EUVD-2025-7048","description":"A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systems by accessing a specific URL that includes the absolute path of the project.","status":"published","published":"2025-03-20T10:08:57Z","modified":"2025-03-20T19:00:18Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:56.973752Z"}],"ghsa":[{"id":"GHSA-qhfv-rxrj-6w5f","title":"A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which...","description":"A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systems by accessing a specific URL that includes the absolute path of the project.","status":"published","published":"2025-03-20T12:32:41Z","modified":"2025-03-20T12:32:45Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:00:22.529672Z"}],"nvd":[{"id":"CVE-2024-11037","description":"A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systems by accessing a specific URL that includes the absolute path of the project.","status":"published","published":"2025-03-20T10:15:23.053Z","modified":"2026-06-17T06:56:55.973Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:45.815983Z"}],"osv":[{"id":"CVE-2024-11037","title":"Path Traversal in binary-husky/gpt_academic","description":"A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systems by accessing a specific URL that includes the absolute path of the project.","status":"published","published":"2025-03-20T10:08:57.513Z","modified":"2026-10-28T02:30:29.807275059Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:37.180532Z"}]}}