CVE-2024-12389

CVE-2024-12389 is a high-severity path traversal vulnerability affecting binary-husky/gpt_academic version git 310122f. It allows an authenticated attacker to upload a malicious 7z file, which, due to improper validation and the behavior of the py7zr package, can write files outside the intended extraction directory. This can lead to arbitrary file writes and ultimately remote code execution. The vulnerability has a CVSS score of 8.8 (High) and is easily exploitable over the network with low privileges and no user interaction. While no public exploits or active exploitation have been observed, and community discussion is minimal, the potential impact is severe.