Description

A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function project_create of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument project_name leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 6e481078cfba6388a67ca2d9792288405019ba3e. Applying a patch is the recommended action to fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-10-05T01:16:28.020Z",
  "pubdate": "2026-10-05T01:16:28.020Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the Project Management component of Gerapy versions up to 0.9.13.\nThe vulnerability resides within the project_create function of gerapy/server/core/views.py.\nAn unauthenticated or remote attacker can manipulate the project_name input argument to escape the intended directory structure.\nThis flaw allows for unauthorized file system access, potentially leading to arbitrary file creation or modification outside the designated project directory.\nThe risk is critical due to the ability for remote exploitation, which could result in full system compromise depending on the application's execution context.\nPublic disclosure of the exploit code increases the urgency for immediate remediation via the provided patch.",
  "technicalDetails": "The vulnerability is a path traversal flaw caused by insufficient input validation within the project_create function in the gerapy/server/core/views.py file.\nWhen a user submits a request to create a project, the application takes the project_name argument and uses it to construct a file system path for project initialization.\nThe application fails to sanitize or validate the project_name input for directory traversal sequences such as '../'.\nAn attacker can exploit this by injecting traversal sequences into the project_name parameter. When the application processes this input, it traverses outside the restricted directory sandbox.\nThe attack flow involves the attacker crafting an HTTP request containing a malicious project_name parameter, such as '..\\..\\..\\..\\path\\to\\target'.\nUpon receipt, the gerapy/server/core/views.py logic concatenates this input with the base directory path.\nBecause the input is not normalized or checked for illegal characters, the operating system interprets the concatenated path according to the traversal sequences, allowing the process to write files into sensitive directories or overwrite existing configuration files.\nThis behavior facilitates remote code execution (RCE) if an attacker can overwrite executable scripts or configuration files that the application subsequently loads or executes.\nThe vulnerability exists in all Gerapy versions up to and including 0.9.13. The lack of strict path validation represents a failure in implementing secure path handling practices, such as using 'os.path.basename' or 'os.path.abspath' to verify that the final path resides within the intended base directory.\nPost-exploitation, an attacker could potentially gain persistent access to the server, extract sensitive information, or disrupt the integrity of the Gerapy environment. Given that the exploit is publicly available, the attack surface is active and requires immediate remediation."
}