{"id":"CVE-2025-55149","aliases":["GHSA-rrgf-hcr9-jq6h","PYSEC-2026-1967"],"title":"TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)","summary":"TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)","severity":"medium","vendor":"tiny-scientist","product":"tiny-scientist","ecosystem":"pip","affected":["tiny-scientist <= 1.1.0"],"published":"2025-08-11","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:27.514533341Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-rrgf-hcr9-jq6h","references":[{"url":"https://github.com/ulab-uiuc/tiny-scientist/security/advisories/GHSA-rrgf-hcr9-jq6h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55149"},{"url":"https://github.com/ulab-uiuc/tiny-scientist/commit/7fd42873603012acb8c55a4fc3eaac9ab18e6559"},{"url":"https://github.com/ulab-uiuc/tiny-scientist"}],"tags":["osv","pip"],"epss":0.00645,"epssPercentile":0.49507,"ingestedAt":"2026-07-08T18:25:53.016Z","slug":"CVE-2025-55149","body":"## Overview\n\n## Description\nA critical path traversal vulnerability (CWE-22) has been identified in the `review_paper` function in `backend/app.py`. The vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass the intended security restrictions.\n\n## Impact\nThis vulnerability allows attackers to:\n- Read any PDF file accessible to the server process\n- Potentially access sensitive documents outside the intended directory\n- Perform reconnaissance on the server's file system structure\n\n## Vulnerable Code\nThe issue occurs in the `review_paper` function around line 744:\n\n```python\nif pdf_path.startswith(\"/api/files/\"):\n    # Safe path handling for API routes\n    relative_path = pdf_path[len(\"/api/files/\"):]\n    generated_base = os.path.join(project_root, \"generated\")\n    absolute_pdf_path = os.path.join(generated_base, relative_path)\nelse:\n    absolute_pdf_path = pdf_path  # VULNERABLE: Direct use of user input\n```\n\n## Proof of Concept\n```bash\ncurl -X POST http://localhost:5000/api/review \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"pdf_path\": \"/etc/passwd\"}'\n```\n\n## Credit\nThis vulnerability was discovered and reported by Ruizhe.\n\n## Affected packages\n\n- `tiny-scientist <= 1.1.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}