{"id":"CVE-2025-10236","summary":"binary-husky gpt_academic LaTeX File latex_toolbox.py merge_tex_files_ path traversal","details":"A vulnerability has been found in binary-husky gpt_academic up to 3.91. Impacted is the function merge_tex_files_ of the file crazy_functions/latex_fns/latex_toolbox.py of the component LaTeX File Handler. Such manipulation of the argument \\input{} leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","modified":"2026-08-12T03:51:38.867965935Z","published":"2025-09-11T01:02:07.190Z","database_specific":{"unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"3.0"},{"last_affected":"3.0"},{"introduced":"3.1"},{"last_affected":"3.1"},{"introduced":"3.2"},{"last_affected":"3.2"},{"introduced":"3.3"},{"last_affected":"3.3"},{"introduced":"3.4"},{"last_affected":"3.4"},{"introduced":"3.5"},{"last_affected":"3.5"},{"introduced":"3.6"},{"last_affected":"3.6"},{"introduced":"3.7"},{"last_affected":"3.7"},{"introduced":"3.8"},{"last_affected":"3.8"},{"introduced":"3.9"},{"last_affected":"3.9"},{"introduced":"3.10"},{"last_affected":"3.10"},{"introduced":"3.11"},{"last_affected":"3.11"},{"introduced":"3.12"},{"last_affected":"3.12"},{"introduced":"3.13"},{"last_affected":"3.13"},{"introduced":"3.14"},{"last_affected":"3.14"},{"introduced":"3.15"},{"last_affected":"3.15"},{"introduced":"3.16"},{"last_affected":"3.16"},{"introduced":"3.17"},{"last_affected":"3.17"},{"introduced":"3.18"},{"last_affected":"3.18"},{"introduced":"3.19"},{"last_affected":"3.19"},{"introduced":"3.20"},{"last_affected":"3.20"},{"introduced":"3.21"},{"last_affected":"3.21"},{"introduced":"3.22"},{"last_affected":"3.22"},{"introduced":"3.23"},{"last_affected":"3.23"},{"introduced":"3.24"},{"last_affected":"3.24"},{"introduced":"3.25"},{"last_affected":"3.25"},{"introduced":"3.26"},{"last_affected":"3.26"},{"introduced":"3.27"},{"last_affected":"3.27"},{"introduced":"3.28"},{"last_affected":"3.28"},{"introduced":"3.29"},{"last_affected":"3.29"},{"introduced":"3.30"},{"last_affected":"3.30"},{"introduced":"3.31"},{"last_affected":"3.31"},{"introduced":"3.32"},{"last_affected":"3.32"},{"introduced":"3.33"},{"last_affected":"3.33"},{"introduced":"3.34"},{"last_affected":"3.34"},{"introduced":"3.35"},{"last_affected":"3.35"},{"introduced":"3.36"},{"last_affected":"3.36"},{"introduced":"3.37"},{"last_affected":"3.37"},{"introduced":"3.38"},{"last_affected":"3.38"},{"introduced":"3.39"},{"last_affected":"3.39"},{"introduced":"3.40"},{"last_affected":"3.40"},{"introduced":"3.41"},{"last_affected":"3.41"},{"introduced":"3.42"},{"last_affected":"3.42"},{"introduced":"3.43"},{"last_affected":"3.43"},{"introduced":"3.44"},{"last_affected":"3.44"},{"introduced":"3.45"},{"last_affected":"3.45"},{"introduced":"3.46"},{"last_affected":"3.46"},{"introduced":"3.47"},{"last_affected":"3.47"},{"introduced":"3.48"},{"last_affected":"3.48"},{"introduced":"3.49"},{"last_affected":"3.49"},{"introduced":"3.50"},{"last_affected":"3.50"},{"introduced":"3.51"},{"last_affected":"3.51"},{"introduced":"3.52"},{"last_affected":"3.52"},{"introduced":"3.53"},{"last_affected":"3.53"},{"introduced":"3.54"},{"last_affected":"3.54"},{"introduced":"3.55"},{"last_affected":"3.55"},{"introduced":"3.56"},{"last_affected":"3.56"},{"introduced":"3.57"},{"last_affected":"3.57"},{"introduced":"3.58"},{"last_affected":"3.58"},{"introduced":"3.59"},{"last_affected":"3.59"},{"introduced":"3.60"},{"last_affected":"3.60"},{"introduced":"3.61"},{"last_affected":"3.61"},{"introduced":"3.62"},{"last_affected":"3.62"},{"introduced":"3.63"},{"last_affected":"3.63"},{"introduced":"3.64"},{"last_affected":"3.64"},{"introduced":"3.65"},{"last_affected":"3.65"},{"introduced":"3.66"},{"last_affected":"3.66"},{"introduced":"3.67"},{"last_affected":"3.67"},{"introduced":"3.68"},{"last_affected":"3.68"},{"introduced":"3.69"},{"last_affected":"3.69"},{"introduced":"3.70"},{"last_affected":"3.70"},{"introduced":"3.71"},{"last_affected":"3.71"},{"introduced":"3.72"},{"last_affected":"3.72"},{"introduced":"3.73"},{"last_affected":"3.73"},{"introduced":"3.74"},{"last_affected":"3.74"},{"introduced":"3.75"},{"last_affected":"3.75"},{"introduced":"3.76"},{"last_affected":"3.76"},{"introduced":"3.77"},{"last_affected":"3.77"},{"introduced":"3.78"},{"last_affected":"3.78"},{"introduced":"3.79"},{"last_affected":"3.79"},{"introduced":"3.80"},{"last_affected":"3.80"},{"introduced":"3.81"},{"last_affected":"3.81"},{"introduced":"3.82"},{"last_affected":"3.82"},{"introduced":"3.83"},{"last_affected":"3.83"},{"introduced":"3.84"},{"last_affected":"3.84"},{"introduced":"3.85"},{"last_affected":"3.85"},{"introduced":"3.86"},{"last_affected":"3.86"},{"introduced":"3.87"},{"last_affected":"3.87"},{"introduced":"3.88"},{"last_affected":"3.88"},{"introduced":"3.89"},{"last_affected":"3.89"},{"introduced":"3.90"},{"last_affected":"3.90"},{"introduced":"3.91"},{"last_affected":"3.91"}]}],"cna_assigner":"VulDB","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10236.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10236.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10236"},{"type":"ADVISORY","url":"https://vuldb.com/?id.323505"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.640977"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.323505"},{"type":"EVIDENCE","url":"https://github.com/d3do-23/cvelist/blob/main/gpt_academic/Plugins_LFI.md"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/binary-husky/gpt_academic","events":[{"introduced":"0"},{"last_affected":"8413fb15ba05c4d1bf245a13096e9a2e03777866"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:binary-husky:gpt_academic:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"3.91"}]}}],"versions":["version3.91","version3.83-fix-1","version3.83","version3.74","version3.70","version3.64-1","version3.60-1","version3.55-2","version3.55","version3.54-2","version3.54","version3.53-2","version3.53-1","version3.52-1","version3.52","version3.50-2","version3.50-1","version3.50","version3.48-1","version3.48","version3.47","version3.45","version3.44","version3.43","version3.42-2","version3.42","version3.41-3","version3.41-2","version3.4-2","version3.4","version3.37-4","version3.37-3","version3.37-2","version3.37","version3.36","version3.35","version3.34","version3.33-2","version3.33","version3.32","version3.3-3","version3.2","version3.15","version3.1-3","version2.7","version3.1-2","version2.68-4","version2.68-3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10236.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}]}