CVE-2025-10236 | binary-husky gpt_academic up to 3.91 LaTeX File latex_toolbox.py merge_tex_files_ input{} path traversal

A vulnerability was found in binary-husky gpt_academic up to 3.91. It has been declared as problematic. Impacted is the function merge_tex_files_ of the file crazy_functions/latex_fns/latex_toolbox.py of the component LaTeX File Handler. Such manipulation of the argument input{} leads to path traversal.

This vulnerability is traded as CVE-2025-10236. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.