CVE-2026-16209: Gerapy Authentication Bypass Vulnerability

CVE-2026-16209 Overview

CVE-2026-16209 is a missing authentication vulnerability in Gerapy versions up to 0.9.13. The flaw resides in the project_upload function within gerapy/server/core/views.py, which handles project uploads through the Project Upload Endpoint. The endpoint did not enforce authentication, allowing unauthenticated remote actors to invoke it. The exploit has been publicly disclosed. Maintainers released a fix identified by commit bd4891c60315f17611a3b7a651ffe0fba7cfe71e, which restores the @permission_classes([IsAuthenticated]) decorator. The weakness maps to [CWE-287] Improper Authentication.

Critical Impact

Unauthenticated remote attackers can upload projects to a Gerapy server, undermining the integrity and confidentiality of managed scraping projects.

Affected Products

• Gerapy versions up to and including 0.9.13
• Component: Project Upload Endpoint (gerapy/server/core/views.py)
• Function: project_upload

Discovery Timeline

• 2026-07-19 - CVE-2026-16209 published to the National Vulnerability Database (NVD)
• 2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-16209

Vulnerability Analysis

Gerapy is a distributed crawler management framework built on Django and Scrapy. The project_upload view in gerapy/server/core/views.py accepts POST requests to upload project archives. In vulnerable releases, the @permission_classes([IsAuthenticated]) decorator was commented out, leaving the endpoint accessible without credentials. Any remote client that can reach the Gerapy HTTP interface can invoke the upload route and submit project content.

The pull request linked to the fix, GitHub Pull Request #319, also references Zip Slip hardening in the same handler. Combined with missing authentication, an unauthenticated actor could interact with archive extraction logic on the server.

EPSS data published on 2026-07-24 lists an exploit probability of 0.41% at the 33.5 percentile.

Root Cause

The root cause is an inactive authorization decorator on a sensitive Django REST Framework view. Without IsAuthenticated enforcement, the view treats anonymous requests as authorized. This is a classic [CWE-287] Improper Authentication defect introduced by disabling access control on a state-changing API.

Attack Vector

The attack vector is network based and requires no privileges or user interaction. An attacker sends an HTTP POST request to the exposed Gerapy Project Upload Endpoint and supplies project data. Because the endpoint is reachable without authentication, exploitation only requires network access to the Gerapy server.

# Security patch in gerapy/server/core/views.py
@log_exception()
@api_view(['POST'])
-# @permission_classes([IsAuthenticated])
+@permission_classes([IsAuthenticated])
def project_upload(request):
    """
    upload project

Source: GitHub Commit bd4891c

The patch re-enables the IsAuthenticated permission class so that Django REST Framework rejects anonymous requests before the upload handler executes.

Detection Methods for CVE-2026-16209

Indicators of Compromise

• Unauthenticated HTTP POST requests to the Gerapy project upload URL originating from external or unexpected internal sources.
• New or modified project directories on the Gerapy host that do not correspond to legitimate operator activity.
• Web server or Django access logs showing successful 2xx responses to project_upload without a preceding authenticated session.

Detection Strategies

• Enable and centralize Django and reverse-proxy access logs, then alert on POSTs to the Gerapy upload route from unauthenticated sessions.
• Baseline expected upload sources and flag requests from IPs outside the operations network.
• Monitor filesystem changes under the Gerapy projects directory for unexpected archive extractions or new files.

Monitoring Recommendations

• Forward Gerapy application and web server logs to a centralized logging or SIEM platform for correlation.
• Track process activity spawned by the Gerapy service account for unexpected Python or Scrapy invocations following an upload.
• Watch for outbound network connections initiated by newly uploaded project code, which can indicate malicious payloads.

How to Mitigate CVE-2026-16209

Immediate Actions Required

• Upgrade Gerapy to a fixed release that includes commit bd4891c60315f17611a3b7a651ffe0fba7cfe71e.
• Restrict network access to the Gerapy management interface using firewall rules, VPN, or reverse proxy access controls until patching is complete.
• Review recent uploads and project directories on Gerapy hosts to identify anonymous or unexpected submissions.

Patch Information

The maintainers merged the fix through GitHub Pull Request #319, addressing GitHub Issue #317. The change re-adds @permission_classes([IsAuthenticated]) to the project_upload view and also introduces Zip Slip prevention during archive extraction. See the GitHub Commit Details and the GitHub Project Repository for release information.

Workarounds

• Place Gerapy behind a reverse proxy that enforces authentication on the upload path.
• Bind the Gerapy service to a loopback or management interface unreachable from untrusted networks.
• Locally apply the decorator fix from commit bd4891c if upgrading is not immediately feasible.

# Example reverse proxy restriction (nginx) protecting the upload endpoint
location /api/project/upload {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://127.0.0.1:8000;
}