A vulnerability has been found in binary-husky gpt_academic up to 3.91. Impacted is the function merge_tex_files_ of the file crazy_functions/latex_fns/latex_toolbox.py of the component LaTeX File Handler. Such manipulation of the argument \input{} leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"cna_assigner": "VulDB",
"cwe_ids": [
"CWE-22"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10236.json",
"unresolved_ranges": [
{
"extracted_events": [
{
"introduced": "3.0"
},
{
"last_affected": "3.0"
},
{
"introduced": "3.1"
},
{
"last_affected": "3.1"
},
{
"introduced": "3.2"
},
{
"last_affected": "3.2"
},
{
"introduced": "3.3"
},
{
"last_affected": "3.3"
},
{
"introduced": "3.4"
},
{
"last_affected": "3.4"
},
{
"introduced": "3.5"
},
{
"last_affected": "3.5"
},
{
"introduced": "3.6"
},
{
"last_affected": "3.6"
},
{
"introduced": "3.7"
},
{
"last_affected": "3.7"
},
{
"introduced": "3.8"
},
{
"last_affected": "3.8"
},
{
"introduced": "3.9"
},
{
"last_affected": "3.9"
},
{
"introduced": "3.10"
},
{
"last_affected": "3.10"
},
{
"introduced": "3.11"
},
{
"last_affected": "3.11"
},
{
"introduced": "3.12"
},
{
"last_affected": "3.12"
},
{
"introduced": "3.13"
},
{
"last_affected": "3.13"
},
{
"introduced": "3.14"
},
{
"last_affected": "3.14"
},
{
"introduced": "3.15"
},
{
"last_affected": "3.15"
},
{
"introduced": "3.16"
},
{
"last_affected": "3.16"
},
{
"introduced": "3.17"
},
{
"last_affected": "3.17"
},
{
"introduced": "3.18"
},
{
"last_affected": "3.18"
},
{
"introduced": "3.19"
},
{
"last_affected": "3.19"
},
{
"introduced": "3.20"
},
{
"last_affected": "3.20"
},
{
"introduced": "3.21"
},
{
"last_affected": "3.21"
},
{
"introduced": "3.22"
},
{
"last_affected": "3.22"
},
{
"introduced": "3.23"
},
{
"last_affected": "3.23"
},
{
"introduced": "3.24"
},
{
"last_affected": "3.24"
},
{
"introduced": "3.25"
},
{
"last_affected": "3.25"
},
{
"introduced": "3.26"
},
{
"last_affected": "3.26"
},
{
"introduced": "3.27"
},
{
"last_affected": "3.27"
},
{
"introduced": "3.28"
},
{
"last_affected": "3.28"
},
{
"introduced": "3.29"
},
{
"last_affected": "3.29"
},
{
"introduced": "3.30"
},
{
"last_affected": "3.30"
},
{
"introduced": "3.31"
},
{
"last_affected": "3.31"
},
{
"introduced": "3.32"
},
{
"last_affected": "3.32"
},
{
"introduced": "3.33"
},
{
"last_affected": "3.33"
},
{
"introduced": "3.34"
},
{
"last_affected": "3.34"
},
{
"introduced": "3.35"
},
{
"last_affected": "3.35"
},
{
"introduced": "3.36"
},
{
"last_affected": "3.36"
},
{
"introduced": "3.37"
},
{
"last_affected": "3.37"
},
{
"introduced": "3.38"
},
{
"last_affected": "3.38"
},
{
"introduced": "3.39"
},
{
"last_affected": "3.39"
},
{
"introduced": "3.40"
},
{
"last_affected": "3.40"
},
{
"introduced": "3.41"
},
{
"last_affected": "3.41"
},
{
"introduced": "3.42"
},
{
"last_affected": "3.42"
},
{
"introduced": "3.43"
},
{
"last_affected": "3.43"
},
{
"introduced": "3.44"
},
{
"last_affected": "3.44"
},
{
"introduced": "3.45"
},
{
"last_affected": "3.45"
},
{
"introduced": "3.46"
},
{
"last_affected": "3.46"
},
{
"introduced": "3.47"
},
{
"last_affected": "3.47"
},
{
"introduced": "3.48"
},
{
"last_affected": "3.48"
},
{
"introduced": "3.49"
},
{
"last_affected": "3.49"
},
{
"introduced": "3.50"
},
{
"last_affected": "3.50"
},
{
"introduced": "3.51"
},
{
"last_affected": "3.51"
},
{
"introduced": "3.52"
},
{
"last_affected": "3.52"
},
{
"introduced": "3.53"
},
{
"last_affected": "3.53"
},
{
"introduced": "3.54"
},
{
"last_affected": "3.54"
},
{
"introduced": "3.55"
},
{
"last_affected": "3.55"
},
{
"introduced": "3.56"
},
{
"last_affected": "3.56"
},
{
"introduced": "3.57"
},
{
"last_affected": "3.57"
},
{
"introduced": "3.58"
},
{
"last_affected": "3.58"
},
{
"introduced": "3.59"
},
{
"last_affected": "3.59"
},
{
"introduced": "3.60"
},
{
"last_affected": "3.60"
},
{
"introduced": "3.61"
},
{
"last_affected": "3.61"
},
{
"introduced": "3.62"
},
{
"last_affected": "3.62"
},
{
"introduced": "3.63"
},
{
"last_affected": "3.63"
},
{
"introduced": "3.64"
},
{
"last_affected": "3.64"
},
{
"introduced": "3.65"
},
{
"last_affected": "3.65"
},
{
"introduced": "3.66"
},
{
"last_affected": "3.66"
},
{
"introduced": "3.67"
},
{
"last_affected": "3.67"
},
{
"introduced": "3.68"
},
{
"last_affected": "3.68"
},
{
"introduced": "3.69"
},
{
"last_affected": "3.69"
},
{
"introduced": "3.70"
},
{
"last_affected": "3.70"
},
{
"introduced": "3.71"
},
{
"last_affected": "3.71"
},
{
"introduced": "3.72"
},
{
"last_affected": "3.72"
},
{
"introduced": "3.73"
},
{
"last_affected": "3.73"
},
{
"introduced": "3.74"
},
{
"last_affected": "3.74"
},
{
"introduced": "3.75"
},
{
"last_affected": "3.75"
},
{
"introduced": "3.76"
},
{
"last_affected": "3.76"
},
{
"introduced": "3.77"
},
{
"last_affected": "3.77"
},
{
"introduced": "3.78"
},
{
"last_affected": "3.78"
},
{
"introduced": "3.79"
},
{
"last_affected": "3.79"
},
{
"introduced": "3.80"
},
{
"last_affected": "3.80"
},
{
"introduced": "3.81"
},
{
"last_affected": "3.81"
},
{
"introduced": "3.82"
},
{
"last_affected": "3.82"
},
{
"introduced": "3.83"
},
{
"last_affected": "3.83"
},
{
"introduced": "3.84"
},
{
"last_affected": "3.84"
},
{
"introduced": "3.85"
},
{
"last_affected": "3.85"
},
{
"introduced": "3.86"
},
{
"last_affected": "3.86"
},
{
"introduced": "3.87"
},
{
"last_affected": "3.87"
},
{
"introduced": "3.88"
},
{
"last_affected": "3.88"
},
{
"introduced": "3.89"
},
{
"last_affected": "3.89"
},
{
"introduced": "3.90"
},
{
"last_affected": "3.90"
},
{
"introduced": "3.91"
},
{
"last_affected": "3.91"
}
],
"source": "AFFECTED_FIELD"
}
]
}{
"cpe": "cpe:2.3:a:binary-husky:gpt_academic:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "3.91"
}
],
"source": "CPE_RANGE"
}