CVE-2025-55149: Path Traversal Vulnerability in TinyScientist PDF Review Function
Summary
CVE-2025-55149: TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22). Affects tiny-scientist versions < 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TinyScientist is a Python package designed for managing and reviewing scientific papers, allowing users to upload and review PDF documents efficiently. It provides functionalities for file handling and user interactions, making it a valuable tool for researchers. However, it has been identified to have a critical path traversal vulnerability that could expose sensitive files on the server.
Vulnerability Detail
A critical path traversal vulnerability (CWE-22) exists in the review_paper function located in backend/app.py. This vulnerability allows malicious users to access arbitrary PDF files on the server by providing crafted file paths that bypass intended security restrictions. Attackers can exploit this flaw to read any PDF file accessible to the server process, potentially accessing sensitive documents outside the intended directory and performing reconnaissance on the server's file system structure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in the review_paper function to validate the file paths before processing them. For example, restrict the allowed paths to a specific directory and sanitize user inputs to prevent traversal attacks. Here is a code snippet to illustrate this:
if pdf_path.startswith("/api/files/"):
# Safe path handling for API routes
relative_path = pdf_path[len("/api/files/"):]
if not os.path.isabs(relative_path):
generated_base = os.path.join(project_root, "generated")
absolute_pdf_path = os.path.join(generated_base, relative_path)
else:
raise ValueError("Invalid file path")
else:
raise ValueError("Invalid file path")
Conclusion
The identified path traversal vulnerability in TinyScientist poses significant risks to server security by allowing unauthorized access to sensitive files. It is crucial to update to the latest version to mitigate these risks and ensure the integrity of your application.
See every vulnerability recorded for tiny-scientist →
FAQ
CVE-2025-55149 is a path traversal vulnerability in the TinyScientist package that allows unauthorized access to arbitrary PDF files on the server.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
The vulnerability can lead to unauthorized reading of sensitive documents, exposure of the server's file system structure, and potential data breaches.
You can update TinyScientist by running the command: pip install --upgrade tiny-scientist to ensure you are using the patched version.
If you cannot update immediately, implement additional path validation and sanitization in your code as a temporary workaround.
