GPT Academic Server-Side Request Forgery Vulnerability in HotReload Plugin

A Server-Side Request Forgery (SSRF) vulnerability has been identified in GPT Academic version 3.83. This issue arises in the HotReload plugin function, which improperly sanitizes API calls to crazy_utils.get_files_from_everything(). As a result, attackers can exploit this vulnerability to misuse the credentials of the affected GPT Academic instance's Gradio Web server, gaining unauthorized access to web resources.

Impact

Exploitation of this vulnerability allows for Server-Side Request Forgery, enabling attackers to access internal resources or external services on behalf of the vulnerable server.