CVE-2025-25185: gpt_academic: symlink traversal exposes all server files

HIGH PoC AVAILABLE

Published March 3, 2025

CISO Take

GPT Academic ≤3.91 contains an unauthenticated path traversal vulnerability (CWE-59) where an attacker packages a malicious symlink inside a tar.gz, uploads it through the application's file upload feature — no login required — and reads any file the web process can access, including .env files, API keys, SSH private keys, and database credentials. With a CVSS of 7.5, zero privileges required, a network-accessible attack vector, low complexity, and a public PoC already published, the risk of exploitation is high for any internet-facing deployment. This package has accumulated 5 CVEs, indicating a pattern of insufficient security attention in the codebase. Organizations running GPT Academic should apply the patch at commit 5dffe862 immediately; if patching is not immediately possible, disable file upload functionality or place the instance behind VPN/HTTP authentication, and rotate all credentials stored on servers that ran a public-facing vulnerable instance.

Sources: NVD GitHub Advisory ATLAS

Risk Assessment

High risk. The attack chain is trivially simple — craft a symlink, tar it, upload it, read the file — and a working PoC is publicly available. No authentication is required and there is no user interaction needed, meaning automated scanning and exploitation is realistic. The read-everything impact means credentials for downstream AI APIs (OpenAI, Anthropic, Google), database passwords, and private user conversation data are all in scope. Deploying this on shared infrastructure multiplies the blast radius well beyond the GPT Academic application itself.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
gpt_academic	pip	—	No patch

Do you use gpt_academic? You're affected.

Severity & Risk

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Recommended Action

Patch immediately: upgrade past commit 5dffe8627f681d7006cebcba27def038bb691949 (fix validated in GHSA-gqp5-wm97-qxcv).
Interim workaround: disable the file upload/decompression feature in GPT Academic's configuration if upgrading cannot be done immediately.
Network hardening: restrict the application to authenticated users (HTTP basic auth, VPN, or Cloudflare Access) — the CVSS PR:N score assumes unauthenticated reach.
Detection: audit web server access logs for POST requests to archive upload endpoints followed by GET requests resolving paths outside the expected working directory; alert on responses serving content from /etc/, /root/, or application root .env files.
Credential rotation: any server that ran a public-facing vulnerable instance should be treated as compromised — rotate all API keys, DB passwords, and SSH keys stored on that host.

Classification

Data Extraction Privacy Violation Framework AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials

Compliance Impact

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.2 - Controls for AI system inputs

NIST AI RMF

MANAGE 2.2 - Risk Treatment — Vulnerability Remediation

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Technical Details

NVD Description

GPT Academic provides interactive interfaces for large language models. In 3.91 and earlier, GPT Academic does not properly account for soft links. An attacker can create a malicious file as a soft link pointing to a target file, then package this soft link file into a tar.gz file and upload it. Subsequently, when accessing the decompressed file from the server, the soft link will point to the target file on the victim server. The vulnerability allows attackers to read all files on the server.

Exploitation Scenario

An attacker queries Shodan or GreyNoise for GPT Academic's HTTP fingerprint (application title or specific UI endpoints) and finds a public instance. They create a symlink named report.txt pointing to /proc/1/environ or ../../.env, package it with tar czf payload.tar.gz report.txt, and POST it to the application's file upload endpoint — no session token required. The server extracts the archive to its working directory. The attacker then accesses the decompressed file via the application's file viewer, and the OS resolves the symlink, returning the contents of the environment file containing OPENAI_API_KEY, DATABASE_URL, and other secrets. The attacker iterates through /etc/passwd, ~/.ssh/id_rsa, and application config paths within minutes using a simple loop, achieving full credential harvest with no special tooling.