CVE-2024-11030

7.5 highEPSS 0.7%

High (7.5) in binary-husky gpt academic. EPSS 0.7% chance of exploitation in the next 30 days.

GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability through its HotReload plugin function, which calls the crazy_utils.get_files_from_everything() API without proper sanitization. This allows attackers to exploit the vulnerability to abuse the victim GPT Academic's Gradio Web server's credentials to access unauthorized web resources.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2025-03-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

binary-husky:gpt_academic

References

https://huntr.com/bounties/729d9928-c28a-40fd-8a86-bb4ca2984bba
https://huntr.com/bounties/729d9928-c28a-40fd-8a86-bb4ca2984bba

Check your stack JSON