CVE-2026-105174 in Gerapy
Summary
by MITRE • 10/05/2026
A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function project_create of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument project_name leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 6e481078cfba6388a67ca2d9792288405019ba3e. Applying a patch is the recommended action to fix this issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Gerapy versions up to 0.9.13 represents a critical security flaw within the Project Management component, specifically located in the project_create function of the gerapy/server/core/views.py file. This weakness stems from insufficient validation and sanitization of user-supplied input when handling the project_name argument. As a result, an attacker can manipulate this parameter to perform path traversal attacks, allowing them to access or modify files outside the intended directory structure on the server hosting the Gerapy application. The presence of public exploit code significantly elevates the risk profile, as it enables adversaries with basic scripting knowledge to successfully leverage this flaw without requiring complex development efforts.
From a technical perspective, this issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. When the application processes the project_name input, it fails to adequately restrict or normalize the path components before using them in file system operations. This oversight permits the injection of directory traversal sequences, such as dot-dot-slash characters, which can redirect file read or write operations to arbitrary locations on the host operating system. Given that Gerapy is a distributed web scraping management platform often deployed with administrative privileges, the ability to traverse paths can lead to severe consequences including unauthorized access to sensitive configuration files, potential code execution if log files are overwritten and subsequently parsed by other services, or complete compromise of the underlying infrastructure through manipulation of critical system resources.
The operational impact of this vulnerability is substantial due to its remote exploitability. An attacker does not need prior authentication on many default configurations or can bypass weak access controls to interact with the project creation endpoint. By sending a specially crafted HTTP request containing malicious path traversal sequences in the project_name field, an adversary can read sensitive files such as environment variables, database credentials, or source code from other projects managed by Gerapy. In more severe scenarios, if the application writes data based on this input to writable directories with appropriate permissions, it could facilitate remote code execution, effectively granting the attacker full control over the server hosting the vulnerable instance. This aligns with ATT&CK technique T1083: File and Directory Discovery, as well as potentially T1564: Host Configuration Modification if files are altered to establish persistence or privilege escalation vectors.
Mitigation strategies must prioritize immediate remediation through software updates. The recommended action is to apply the patch identified by commit hash 6e481078cfba6388a67ca2d9792288405019ba3e, which addresses the input validation logic within the project_create function. Until the patch can be applied in production environments, administrators should implement strict access controls to limit exposure of the Gerapy interface to untrusted networks and ensure that only authorized users have permission to create projects or manage server resources. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking path traversal patterns may provide temporary protection against exploitation attempts while longer-term architectural improvements are considered. Future development should enforce strict allow-listing for project names and utilize secure file handling APIs that abstract direct path manipulation, thereby eliminating the root cause of this class of vulnerabilities across all components of the application.