cnvd - cnvd-2025-22726

cnvd-2025-22726

Vulnerability from cnvd

Title

GPT Academic存在未明漏洞

Description

GPT Academic是一个为GPT/GLM等LLM大语言模型提供实用化交互的接口。 GPT Academic存在安全漏洞，该漏洞源于特制zip炸弹上传，攻击者可利用该漏洞导致内存耗尽崩溃。

Severity

中

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4

Reference

https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4

Impacted products

Name
GPT Academic GPT Academic 3.83

Show details on source website

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-12387",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-12387"
    }
  },
  "description": "GPT Academic\u662f\u4e00\u4e2a\u4e3aGPT/GLM\u7b49LLM\u5927\u8bed\u8a00\u6a21\u578b\u63d0\u4f9b\u5b9e\u7528\u5316\u4ea4\u4e92\u7684\u63a5\u53e3\u3002\n\nGPT Academic\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7279\u5236zip\u70b8\u5f39\u4e0a\u4f20\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u5185\u5b58\u8017\u5c3d\u5d29\u6e83\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-22726",
  "openTime": "2025-09-28",
  "products": {
    "product": "GPT Academic GPT Academic 3.83"
  },
  "referenceLink": "https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4",
  "serverity": "\u4e2d",
  "submitTime": "2025-03-27",
  "title": "GPT Academic\u5b58\u5728\u672a\u660e\u6f0f\u6d1e"
}

CVE-2024-12387 (GCVE-0-2024-12387)

Vulnerability from cvelistv5

Published

2025-03-20 10:11

Modified

2025-10-15 12:49

Severity ?

6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Summary

A vulnerability in the binary-husky/gpt_academic repository, as of commit git 3890467, allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the uploaded file and attempts to load it into memory, which can lead to an out-of-memory crash. This issue arises due to improper input validation when handling compressed file uploads.

References

URL

Tags

https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4

Impacted products

	Vendor	Product	Version
	binary-husky	binary-husky/gpt_academic	Version: unspecified <

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-12387",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-20T13:06:23.564889Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-20T13:06:27.128Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "binary-husky/gpt_academic",
          "vendor": "binary-husky",
          "versions": [
            {
              "lessThanOrEqual": "latest",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the binary-husky/gpt_academic repository, as of commit git 3890467, allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the uploaded file and attempts to load it into memory, which can lead to an out-of-memory crash. This issue arises due to improper input validation when handling compressed file uploads."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-15T12:49:30.933Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntr_ai"
      },
      "references": [
        {
          "url": "https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4"
        }
      ],
      "source": {
        "advisory": "02b4ab21-d29b-4cd7-ad80-f83081ce82a4",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Input Validation in binary-husky/gpt_academic"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntr_ai",
    "cveId": "CVE-2024-12387",
    "datePublished": "2025-03-20T10:11:21.371Z",
    "dateReserved": "2024-12-09T21:00:36.453Z",
    "dateUpdated": "2025-10-15T12:49:30.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.