The vulnerability is a deserialization flaw in GPT Academic’s upload endpoint that permits an unauthenticated attacker to supply malicious data, which the server processes without validation. This flaw enables arbitrary code execution that can be performed with root privileges, granting full control over the affected host.

The flaw affects GPT Academic version 3.91. No other vendors or products are listed in the CNA data, and the CPE confirms the product in question.

The CVSS base score of 9.8 indicates a critical severity level, while the EPSS score of 2% suggests a moderate probability of exploitation at this time. The vulnerability is not currently in the CISA KEV catalog, yet the lack of authentication requirements and the root‑level execution potential make it an urgent risk. An attacker would most likely exploit this weakness by sending a crafted payload to the upload endpoint through an unauthenticated HTTP request, triggering insecure deserialization and achieving code execution on the server.