CVE-2026-105174 Gerapy CVE debrief

Who should care

Defenders responsible for Gerapy deployments should assess exposure and apply the patch. Security teams and vulnerability management teams should review the impact of this vulnerability on their environments and prioritize patching. Operators and administrators of Gerapy should verify if their deployments are affected and take necessary actions to prevent exploitation. This vulnerability may impact the security of affected systems, and defenders should be

Why it matters

CVE-2026-105174 is a path traversal vulnerability in Gerapy up to 0.9.13. Defenders should apply the patch and verify affected versions.

• Path traversal attacks may lead to unauthorized file access
• Verify patch application to prevent exploitation

Technical summary

The project_create function in gerapy/server/core/views.py is vulnerable to path traversal. The manipulation of the project_name argument allows for path traversal attacks. This vulnerability can lead to unauthorized file access or other security issues if exploited. The patch 6e481078cfba6388a67ca2d9792288405019ba3e fixes the vulnerability by properly handling the project_name argument. Defenders should apply the patch and verify affected versions to prevent exploitation. The vulnerability has been publicly disclosed, and remote exploitation is possible.

Defensive priority

Apply patch 6e481078cfba6388a67ca2d9792288405019ba3e to fix the path traversal vulnerability in Gerapy up to 0.9.13.

Recommended defensive actions

• Apply patch 6e481078cfba6388a67ca2d9792288405019ba3e
• Verify affected versions of Gerapy
• Restrict access to the project_create function
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the affected versions and potential impact require further verification. The vulnerability is confirmed in Gerapy up to 0.9.13, and defenders should verify if their deployments are affected. The patch 6e481078cfba6388a67ca2d9792288405019ba3e should be applied to fix the issue. Evidence of patch application and verification of affected versions is necessary to ensure the vulnerability is properly mitigated.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.