https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 20:46:52 +0000 https://cve.radiocsirt.org/vuln/cve-2025-55149 <p><strong>Affected:</strong> ulab-uiuc tiny-scientist</p> <p>Tiny-Scientist is a lightweight framework for automating the entire lifecycle of scientific research—from ideation to implementation, writing, and review. In versions 0.1.1 and below, a critical path traversal vulnerability has been identified in the review_paper function in backend/app.py. The vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass the intended security restrictions. This vulnerability allows attackers to: read any PDF file accessible to the server process, potentially access sensitive documents outside the intended directory and perform reconnaissance on the server&#39;s file system structure. This issue does not currently have a fix.</p> <p><strong>Affected:</strong> ulab-uiuc tiny-scientist</p> <p>Tiny-Scientist is a lightweight framework for automating the entire lifecycle of scientific research—from ideation to implementation, writing, and review. In versions 0.1.1 and below, a critical path traversal vulnerability has been identified in the review_paper function in backend/app.py. The vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass the intended security restrictions. This vulnerability allows attackers to: read any PDF file accessible to the server process, potentially access sensitive documents outside the intended directory and perform reconnaissance on the server&#39;s file system structure. This issue does not currently have a fix.</p> https://cve.radiocsirt.org/vuln/cve-2025-55149 https://cve.radiocsirt.org/vuln/pysec-2026-1967 <p><strong>Affected:</strong> PyPI: tiny-scientist</p> <p>## Description A critical path traversal vulnerability (CWE-22) has been identified in the `review_paper` function in `backend/app.py`. The vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass the intended security restrictions.</p> <p>## Impact This vulnerability allows attackers to: - Read any PDF file accessible to the server process - Potentially access sensitive documents outside the intended directory - Perform reconnaissance on the server&#39;s file system structure</p> <p>## Vulnerable Code The issue occurs in the `review_paper` function around line 744:</p> <p>```python if pdf_path.startswith(&#34;/api/files/&#34;): # Safe path handling for API routes relative_path = pdf_path[len(&#34;/api/files/&#34;):] generated_base = os.path.join(project_root, &#34;generated&#34;) absolute_pdf_path = os.path.join(generated_base, relative_path) else: absolute_pdf_path = pdf_path # VULNERABLE: Direct use of user input ```</p> <p>## Proof of Concept ```bash curl -X POST http://localhost:5000/api/review \ -H &#34;Content-Type: application/json&#34; \ -d &#39;{&#34;pdf_path&#34;: &#34;/etc/passwd&#34;}&#39; ```</p> <p>## Credit This vulnerability was discovered and reported by Ruizhe.</p> <p><strong>Affected:</strong> PyPI: tiny-scientist</p> <p>## Description A critical path traversal vulnerability (CWE-22) has been identified in the `review_paper` function in `backend/app.py`. The vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass the intended security restrictions.</p> <p>## Impact This vulnerability allows attackers to: - Read any PDF file accessible to the server process - Potentially access sensitive documents outside the intended directory - Perform reconnaissance on the server&#39;s file system structure</p> <p>## Vulnerable Code The issue occurs in the `review_paper` function around line 744:</p> <p>```python if pdf_path.startswith(&#34;/api/files/&#34;): # Safe path handling for API routes relative_path = pdf_path[len(&#34;/api/files/&#34;):] generated_base = os.path.join(project_root, &#34;generated&#34;) absolute_pdf_path = os.path.join(generated_base, relative_path) else: absolute_pdf_path = pdf_path # VULNERABLE: Direct use of user input ```</p> <p>## Proof of Concept ```bash curl -X POST http://localhost:5000/api/review \ -H &#34;Content-Type: application/json&#34; \ -d &#39;{&#34;pdf_path&#34;: &#34;/etc/passwd&#34;}&#39; ```</p> <p>## Credit This vulnerability was discovered and reported by Ruizhe.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1967