CVE-2024-10986

GPT Academic version 3.83 is vulnerable to a Local File Read (LFI) vulnerability through its HotReload function. This function can download and extract tar.gz files from arxiv.org. Despite implementing protections against path traversal, the application overlooks the Tarslip triggered by symlinks. This oversight allows attackers to read arbitrary local files from the victim server.

• CWE-59

• https://huntr.com/bounties/db2167f5-f17f-491d-aeec-69ba55bf6427Exploit, Third Party Advisory

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10976Incomplete tracking in PostgreSQL of tables with row securit…5.4
• CVE-2024-10977Client use of server error message in PostgreSQL allows a se…3.7
• CVE-2024-10978Incorrect privilege assignment in PostgreSQL allows a less-p…4.2
• CVE-2024-10979Incorrect control of environment variables in PostgreSQL PL/…8.8
• CVE-2024-1098A vulnerability was found in Rebuild up to 3.5.5 and classif…7.5
• CVE-2024-10980The Element Pack Elementor Addons (Header Footer, Template L…5.4
• CVE-2024-10987A vulnerability was found in code-projects E-Health Care Sys…6.5
• CVE-2024-10988A vulnerability was found in code-projects E-Health Care Sys…9.1
• CVE-2024-10989A vulnerability classified as critical has been found in cod…6.5
• CVE-2024-1099A vulnerability was found in Rebuild up to 3.5.5. It has bee…5.4
• CVE-2024-10990A vulnerability classified as critical was found in SourceCo…8.8
• CVE-2024-10991A vulnerability, which was classified as critical, has been …9.8