CVE-2024-12389: GPT Academic Path Traversal Vulnerability

CVE-2024-12389 Overview

CVE-2024-12389 is a path traversal vulnerability in binary-husky/gpt_academic at git commit 310122f. The application accepts user-provided 7z archives and extracts them using the Python py7zr package without validating archive entry paths. The py7zr library does not guarantee that extracted files remain within the intended output directory. An authenticated attacker can craft a malicious 7z archive containing entries with traversal sequences to write files to arbitrary locations on the host. Arbitrary file writes in this context lead to remote code execution by overwriting application files or dropping executable payloads in startup paths.

Critical Impact
Authenticated attackers can achieve arbitrary file write and remote code execution by uploading a crafted 7z archive.

Affected Products

binary-husky/gpt_academic git commit 310122f
binary-husky:gpt_academic version 2024-10-15
Deployments using py7zr for user-supplied archive extraction

Discovery Timeline

2025-03-20 - CVE-2024-12389 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12389

Vulnerability Analysis

The vulnerability is classified as [CWE-29] Path Traversal: \..\filename. gpt_academic exposes functionality that lets users upload 7z archives for automated extraction and processing. The extraction routine passes archive contents to py7zr without normalizing or validating entry names against the destination directory. Archive formats permit relative path components such as ../ inside member names. When the extractor writes these members using os.path.join without a containment check, the resulting path resolves outside the intended extraction root.

Attackers exploit this to overwrite Python source files loaded by the application, drop files into cron directories, or place SSH authorized keys. Any writable location reachable by the service account becomes a target. Because the application executes Python code, overwriting an imported module or a scheduled task yields code execution on the next invocation.

Root Cause

The root cause is missing path canonicalization in the archive handling code. py7zr.SevenZipFile.extractall() writes each archive entry to a path derived from its stored name. The application does not verify that the resolved absolute path stays within the extraction directory before writing. The library documentation does not guarantee containment, placing the responsibility on the caller.

Attack Vector

Exploitation requires network access to the gpt_academic upload endpoint and low-privilege authentication. The attacker prepares a 7z archive containing entries whose filenames include traversal sequences targeting sensitive paths. Submitting the archive through the standard upload workflow triggers extraction and file placement outside the sandbox. See the Huntr Bug Bounty Report for the reported reproduction.

No verified public proof-of-concept code is available. The vulnerability mechanism follows the standard Zip Slip pattern applied to the 7z format via py7zr.

Detection Methods for CVE-2024-12389

Indicators of Compromise

Uploaded 7z files containing entry names with ../ or absolute path sequences
Unexpected files created outside the gpt_academic extraction working directory
Modifications to .py files inside the application installation path following an upload event
New or modified files in ~/.ssh/, cron directories, or systemd unit paths for the service account

Detection Strategies

Inspect archive contents server-side before extraction and log any member name containing .. or absolute paths
Monitor filesystem write events by the gpt_academic process outside its designated upload and cache directories
Correlate HTTP upload requests to gpt_academic endpoints with subsequent unexpected process launches or file modifications

Monitoring Recommendations

Enable audit logging on directories that host the application source and the service account home
Alert on new executable files or Python modules written by the gpt_academic process
Track outbound network connections initiated after archive upload events for signs of reverse shell activity

How to Mitigate CVE-2024-12389

Immediate Actions Required

Disable user-facing 7z upload and extraction features until a patched version is deployed
Restrict access to the gpt_academic instance to trusted, authenticated users only
Run the application under a low-privilege service account with no write access outside its working directory
Isolate the service inside a container or sandbox with read-only mounts for application code

Patch Information

No vendor advisory URL is listed in the NVD entry at the time of publication. Users should track the binary-husky/gpt_academic repository for a fix beyond commit 310122f. Review the Huntr Bug Bounty Report for the maintainer's remediation status.

Workarounds

Validate every archive entry by resolving its absolute path and confirming it remains under the extraction directory before writing
Reject archives whose member names contain .., drive letters, or leading path separators
Replace direct py7zr.extractall() calls with a custom extractor that iterates entries and enforces containment
Enforce filesystem-level restrictions using AppArmor, SELinux, or container read-only mounts to prevent writes outside the intended path

bash

# Configuration example: containment check before extraction
python -c "import os,sys; base=os.path.realpath('./extract_dir'); target=os.path.realpath(os.path.join(base, sys.argv[1])); sys.exit(0 if target.startswith(base + os.sep) else 1)"