제출 #970586: Gerapy 0.9.13 / master (f2c2a9772a718cb7879e0b6db002b7cfda7c4156) Path Traversal

Gerapy contains an authenticated path traversal vulnerability in its project-management functionality. The application accepts .. as a project name without adequately validating or canonicalizing the supplied value before persisting and using it in filesystem operations.

In gerapy/server/core/views.py, the project_create function persists the user-supplied project name before attempting to create the corresponding directory. A project name containing .. may therefore remain associated with the project record.

Subsequently, project_remove uses the stored project name to construct the deletion target from PROJECTS_FOLDER/project_name and passes the resulting path to rmtree() without verifying that the canonicalized path remains within PROJECTS_FOLDER.

When project_name=.. is used, the resulting path is equivalent to:

PROJECTS_FOLDER/..

After path resolution, the target corresponds to the parent directory of PROJECTS_FOLDER, allowing the recursive deletion operation to target the Gerapy workspace instead of an individual project directory.

Technical Details

The vulnerability results from the combination of two security issues:

1. Insufficient validation of the project name before it is persisted and used in filesystem paths.
2. Absence of a canonical-path containment check before executing rmtree().

The vulnerable flow occurs between the project creation and removal operations.

An authenticated user with project-management access can supply:

project_name=..

The value can be stored as the project name and subsequently reused during project removal.

The removal operation constructs the target using:

PROJECTS_FOLDER/project_name

With the malicious value, this results in:

PROJECTS_FOLDER/..

The filesystem resolves this path to the parent directory of PROJECTS_FOLDER. Because no validation ensures that the final target remains strictly within the project root, the resulting path can be passed to rmtree() while pointing to the Gerapy workspace.

Relevant source locations:

gerapy/server/core/views.py:320-327
gerapy/server/core/views.py:396-407
gerapy/server/core/models.py:28-42

Exploitation Vector

Exploitation requires an authenticated account with access to the project-management functionality.

The attack consists of introducing a project name containing the .. traversal component and subsequently triggering the removal functionality for that project.

No interaction from another user is required.

The ability to remove the targeted files depends on the operating-system filesystem permissions granted to the Gerapy process.

Security Impact

The vulnerability allows an authenticated user with project-management access to escape the intended project-directory boundary and cause a recursive deletion operation to target the Gerapy workspace.

If the Gerapy process has sufficient filesystem permissions, successful exploitation may result in recursive deletion of the workspace, potentially removing:

Managed project source code and files.
Project-related data and artifacts.
Application and project logs.
Database files stored within the workspace.
Configuration files and runtime data.
Other files accessible within the affected directory tree.

Deletion of these resources may result in permanent data loss, corruption of application state, disruption of managed projects, and significant or complete unavailability of the affected Gerapy instance.

The primary security impact is to Integrity and Availability.

Arbitrary code execution is not required to achieve the impact because the application's legitimate recursive deletion functionality is redirected outside the intended project-directory boundary.

Classification

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

CVSS v3.1

8.1 - High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CVSS Rationale

AV:N - The vulnerable functionality is accessible through the application/API.

AC:L - Exploitation does not depend on complex conditions.

PR:L - An authenticated account with project-management access is required.

UI:N - No interaction from another user is required.

S:U - The impact remains within the security authority of the affected application.

C:N - No direct confidentiality impact has been identified.

I:H - Workspace files and data may be deleted.

A:H - Deletion of the workspace may cause significant or complete unavailability of the application and managed projects.

Remediation

Gerapy should strictly validate project names before persisting them or using them in filesystem operations.

Values containing .., absolute paths, directory separators, or other components capable of altering path resolution should be rejected.

In addition to input validation, all destructive filesystem operations should resolve or canonicalize the final target and verify that it remains strictly contained within PROJECTS_FOLDER before executing rmtree().

The application should explicitly prevent deletion when the resolved target corresponds to PROJECTS_FOLDER, its parent directory, the Gerapy workspace, or any path outside the permitted project root.

• 원천: ⚠️ https://github.com/Gerapy/Gerapy/security
• 사용자: volksec (UID 93050)
• 제출: 2026. 09. 09. PM 07:34 (25 날 ago)
• 모더레이션: 2026. 10. 04. AM 10:42 (25 days later)
• 상태: 수락
• VulDB 항목: 413406 [Gerapy 까지 0.9.13 Project Management views.py project_create project_name 디렉토리 순회]
• 포인트들: 20