CVE-2026-105174: Gerapy Path Traversal Vulnerability

CVE-2026-105174 Overview

CVE-2026-105174 is a path traversal vulnerability [CWE-22] affecting Gerapy versions up to 0.9.13. The flaw resides in the project_create function within gerapy/server/core/views.py, part of the Project Management component. An attacker can manipulate the project_name argument to traverse directories outside the intended project directory. The exploit is remotely reachable and has been publicly disclosed. The maintainers released a patch under commit 6e481078cfba6388a67ca2d9792288405019ba3e that also adds authentication enforcement on project upload endpoints.

Critical Impact
Authenticated remote attackers can write or create project files outside the intended directory, affecting file integrity and availability on the Gerapy host.

Affected Products

Gerapy up to and including version 0.9.13
Component: Project Management (gerapy/server/core/views.py)
Function: project_create

Discovery Timeline

2026-10-05 - CVE-2026-105174 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105174

Vulnerability Analysis

Gerapy is a distributed crawler management framework built on Scrapy and Django. The project_create function in gerapy/server/core/views.py accepts a user-supplied project_name argument and uses it to construct a filesystem path for the new project. Because the input is not normalized or validated against a safe base directory, an attacker can supply sequences such as ../ to escape the intended projects directory. This allows directory traversal into arbitrary filesystem locations writable by the Gerapy service account.

The companion issue tracked in the upstream repository also identified a related Zip Slip condition in project_upload, where archive entries could be extracted outside the target directory.

Root Cause

The root cause is missing input sanitization on the project_name parameter before path concatenation. The function does not canonicalize the resulting path or verify that it remains inside the designated project root. Additionally, the pre-patch code commented out @permission_classes([IsAuthenticated]) on upload endpoints, weakening access controls on adjacent project management operations.

Attack Vector

An authenticated remote attacker sends a crafted HTTP POST request to the Gerapy project management API with a project_name value containing traversal sequences. Successful exploitation enables file creation or overwriting outside the project directory, which can impact application integrity and availability. The attack is network-reachable and requires low privileges.

python

# Security patch excerpt from gerapy/server/core/views.py
@log_exception()
@api_view(['POST'])
-# @permission_classes([IsAuthenticated])
+@permission_classes([IsAuthenticated])
def project_upload(request):
    """
    upload project

Source: GitHub Commit 6e48107

The patch re-enables the IsAuthenticated permission decorator and introduces Zip Slip prevention for archive extraction in the project upload path.

Detection Methods for CVE-2026-105174

Indicators of Compromise

HTTP requests to Gerapy project management endpoints containing ../, ..\\, or URL-encoded traversal sequences in the project_name field.
Unexpected files or directories appearing outside the configured Gerapy projects root.
Modifications to Django configuration files, Scrapy project definitions, or Python source files under paths not managed by Gerapy.

Detection Strategies

Inspect Gerapy and reverse proxy access logs for POST requests to project creation endpoints with suspicious project_name values.
Enable file integrity monitoring on the Gerapy installation directory and parent directories to flag writes outside the expected project folder.
Deploy web application firewall rules that match traversal patterns in JSON request bodies targeting Gerapy APIs.

Monitoring Recommendations

Monitor process execution and file creation by the Gerapy service account for writes to sensitive directories such as /etc, /root, or home directories.
Alert on anomalous Django REST Framework authentication failures followed by successful project creation activity.
Track outbound network connections from Gerapy workers that may indicate secondary payload execution following file placement.

How to Mitigate CVE-2026-105174

Immediate Actions Required

Upgrade Gerapy to the patched release that incorporates commit 6e481078cfba6388a67ca2d9792288405019ba3e.
Restrict network exposure of the Gerapy management interface to trusted administrative networks or VPN only.
Rotate credentials for any Gerapy accounts that could have been used to reach the vulnerable endpoint.

Patch Information

The fix is published in the upstream repository under commit 6e481078cfba6388a67ca2d9792288405019ba3e, associated with GitHub Pull Request #319 and GitHub Issue #317. The patch enforces IsAuthenticated on affected API endpoints and adds Zip Slip protections during archive extraction. Additional vulnerability metadata is available at VulDB CVE-2026-105174.

Workarounds

Place Gerapy behind an authenticated reverse proxy that validates request bodies and strips traversal sequences from JSON fields.
Run the Gerapy service under a dedicated low-privilege user with a chroot or container boundary that confines filesystem writes.
Temporarily disable the project creation and upload endpoints at the proxy layer until the patched version is deployed.

bash

# Example nginx snippet to block traversal patterns in project_name values
location /api/project/ {
    if ($request_body ~* "project_name\"\s*:\s*\"[^\"]*(\.\./|\.\.\\\\|%2e%2e)") {
        return 403;
    }
    proxy_pass http://gerapy_backend;
}