CVE-2025-10236: Binary-husky Gpt Academic Path Traversal

CVE-2025-10236 Overview

CVE-2025-10236 is a path traversal vulnerability [CWE-22] affecting binary-husky gpt_academic versions up to 3.91. The flaw resides in the merge_tex_files_ function within crazy_functions/latex_fns/latex_toolbox.py, part of the LaTeX File Handler component. Attackers manipulate the \input{} argument to traverse directories and access files outside the intended scope. The exploit has been publicly disclosed, and the vendor did not respond to early disclosure attempts. Authenticated remote attackers can trigger the issue over the network.

Critical Impact
Authenticated remote attackers can read arbitrary files accessible to the gpt_academic process by abusing LaTeX \input{} directives processed by the merge function.

Affected Products

binary-husky gpt_academic versions up to and including 3.91
Deployments exposing the LaTeX plugin functionality
Self-hosted instances integrating the latex_toolbox.py module

Discovery Timeline

2025-09-11 - CVE-2025-10236 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10236

Vulnerability Analysis

The vulnerability stems from improper sanitization of file path arguments inside the merge_tex_files_ function in crazy_functions/latex_fns/latex_toolbox.py. The function processes LaTeX \input{} directives to merge referenced .tex files into a combined document. An attacker controls the path supplied to \input{}, including relative traversal sequences such as ../. The function resolves these sequences and reads files outside the intended LaTeX project directory.

The issue is classified as path traversal [CWE-22]. Successful exploitation discloses file contents to the attacker through the merged LaTeX output. The vulnerability requires low-privilege authentication but no user interaction, and operates over the network through the gpt_academic plugin interface.

Root Cause

The merge_tex_files_ function trusts user-controlled \input{} arguments without canonicalizing the resulting path or constraining resolution to a project root directory. Standard defenses such as resolving the absolute path and verifying it remains within an allowlisted base directory are absent. LaTeX traversal payloads therefore reach the file system layer unchanged.

Attack Vector

An authenticated user submits a crafted .tex document to the LaTeX plugin. The document contains an \input{} directive referencing a relative path that traverses outside the working directory, for example targeting configuration files or credentials accessible to the application process. The merge routine reads the targeted file and embeds its contents into the consolidated output returned to the attacker. Refer to the GitHub LFI Plugin Documentation for the published proof of concept and payload details.

Detection Methods for CVE-2025-10236

Indicators of Compromise

LaTeX submissions containing \input{} directives with relative traversal sequences such as ../../
Application logs showing file reads outside the configured LaTeX project working directory
Unexpected access to sensitive files (/etc/passwd, configuration files, API keys) by the gpt_academic process
Output documents containing content from non-LaTeX source files

Detection Strategies

Inspect uploaded .tex files for \input{}, \include{}, or \subimport{} arguments containing .. sequences or absolute paths
Audit process file access telemetry against an allowlist of expected LaTeX project directories
Correlate plugin invocations with subsequent file reads outside the working directory

Monitoring Recommendations

Enable verbose logging within crazy_functions/latex_fns/latex_toolbox.py to record all paths resolved by merge_tex_files_
Monitor authenticated plugin usage by user identity to identify anomalous LaTeX submissions
Alert on file read operations targeting paths outside the application's designated workspace

How to Mitigate CVE-2025-10236

Immediate Actions Required

Restrict access to the gpt_academic instance to trusted users and require authentication on all plugin endpoints
Disable the LaTeX merge plugin until a patched release is available if the functionality is not required
Run the application under a dedicated low-privilege account with file system access limited to required directories

Patch Information

At the time of publication, the upstream binary-husky project had not responded to disclosure. No official patched release is referenced in the advisory. Track the VulDB entry #323505 and the project repository for fix availability, and review the public disclosure for technical context.

Workarounds

Deploy gpt_academic inside a container or chroot with read-only access limited to the LaTeX workspace
Add an input filter that rejects \input{} arguments containing .., absolute paths, or non-.tex extensions
Canonicalize resolved file paths and verify they remain within the configured project root before reading
Apply mandatory access control profiles (AppArmor, SELinux) restricting reachable file paths for the process

bash

# Configuration example: restrict the gpt_academic working directory using systemd sandboxing
[Service]
User=gptacademic
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/gpt_academic/workspace
ReadOnlyPaths=/opt/gpt_academic
PrivateTmp=true
NoNewPrivileges=true