CVE-2024-10986: GPT Academic Path Traversal Vulnerability

CVE-2024-10986 Overview

CVE-2024-10986 is a Local File Inclusion (LFI) vulnerability in GPT Academic version 3.83, an open-source AI research assistant maintained by binary-husky. The flaw resides in the HotReload function, which downloads and extracts tar.gz archives from arxiv.org. While the application validates against traditional path traversal sequences, it fails to account for symbolic links inside archives, enabling a Tarslip attack. An authenticated remote attacker can craft a malicious archive that, once extracted, resolves symlinks to arbitrary files on the host and returns their contents. This grants read access to sensitive configuration files, credentials, and application secrets on the victim server.

Critical Impact
Authenticated attackers can read arbitrary files on the server hosting GPT Academic 3.83, exposing credentials, API keys, and configuration data.

Affected Products

binary-husky/gpt_academic version 3.83
Deployments exposing the HotReload archive extraction feature
Instances that ingest external tar.gz archives referenced through arXiv workflows

Discovery Timeline

2025-03-20 - CVE-2024-10986 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10986

Vulnerability Analysis

GPT Academic's HotReload feature retrieves papers and supporting materials from arXiv as tar.gz archives. The extraction routine sanitizes entry names to block path traversal patterns such as ../. It does not, however, validate the target of symbolic link entries stored inside the archive. This omission introduces a Tarslip condition classified under CWE-59: Link Following.

When the archive is unpacked, the tar handler creates the symlink verbatim on disk. Subsequent reads that follow the symlink resolve to arbitrary absolute paths chosen by the attacker. The application then serves the linked file content back through its analysis workflow, producing a reliable arbitrary-file-read primitive.

Root Cause

The root cause is incomplete archive validation. The extraction logic checks entry names but does not inspect entry types or verify that symlink targets remain within the extraction root. Standard hardening patterns, such as rejecting LNKTYPE and SYMTYPE members or resolving link targets before writing, are absent from the affected code path.

Attack Vector

Exploitation requires network access and low-privilege authentication to the GPT Academic instance. An attacker publishes or references a crafted tar.gz archive containing a symlink entry pointing to a sensitive host path, for example /etc/passwd or an application .env file. When HotReload retrieves and extracts the archive, the symlink is written. The application then reads through the symlink and returns file contents in its response, completing the local file read.

No verified public exploit code is available. Refer to the Huntr bounty listing for the disclosure details.

Detection Methods for CVE-2024-10986

Indicators of Compromise

Unexpected symbolic links appearing under GPT Academic extraction and cache directories
Outbound requests from the application server to non-arXiv hosts serving tar.gz payloads
Access log entries showing HotReload invocations followed by reads of sensitive paths such as /etc/passwd, /proc/self/environ, or application secret files
Process activity where the GPT Academic worker opens files outside its working directory

Detection Strategies

Inspect archives fetched by HotReload for entries with type flag SYMTYPE or LNKTYPE before extraction
Alert on file open events by the GPT Academic process that traverse symlinks to paths outside the intended extraction root
Correlate archive downloads with subsequent reads of high-value files using endpoint telemetry

Monitoring Recommendations

Enable audit logging on the host filesystem for open and readlink syscalls originating from the application user
Monitor the extraction directory for newly created symbolic links using inotify or equivalent tooling
Forward application and system logs to a centralized platform for correlation across archive fetch, extraction, and file access events

How to Mitigate CVE-2024-10986

Immediate Actions Required

Upgrade GPT Academic beyond version 3.83 once a fixed release is available from the binary-husky/gpt_academic maintainers
Restrict access to the GPT Academic web interface to trusted, authenticated users only
Run the application under a dedicated low-privilege service account with no read access to secrets, keys, or system configuration files
Isolate the workload in a container or sandbox with a read-only root filesystem where feasible

Patch Information

At the time of NVD publication, no vendor advisory URL is listed in the CVE record. Track the Huntr bounty listing and the upstream binary-husky/gpt_academic repository for the fixed release and commit references.

Workarounds

Disable the HotReload archive ingestion feature until a patched version is deployed
Extract archives inside an ephemeral sandbox that blocks symlink creation, for example by passing extraction flags that reject non-regular file entries
Pre-process incoming tar.gz archives to strip symlink and hardlink entries before the application processes them
Apply mandatory access controls such as AppArmor or SELinux profiles that confine the process to its working directory

bash

# Configuration example: strip symlink entries before extraction
tar --exclude-tag-all=SYMTYPE --no-same-owner -tzf paper.tar.gz | \
  grep -v '^l' > safe_entries.txt
tar -xzf paper.tar.gz -C /opt/gpt_academic/sandbox \
  --files-from=safe_entries.txt \
  --no-overwrite-dir --no-same-permissions