# CVE-2026-105174: Gerapy path traversal in project creation

Source: https://junglewise.ai/threats/cve-2026-105174-a-vulnerability-has-been-found-in-gerapy-up-to-0-9-13-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105174 · Severity: medium · CVSS 5.4 · Published 2026-10-05

Gerapy is a distributed crawler management framework that allows users to create and manage web scraping projects. A path traversal vulnerability in the project creation function allows an attacker to write files outside the intended project directory, potentially leading to arbitrary code execution or data manipulation on the server.

Technologies: [Gerapy](https://junglewise.ai/threats/technologies/gerapy). Vendors: [Gerapy](https://junglewise.ai/threats/vendors/gerapy).

## Quick answers

**Is CVE-2026-105174 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105174 being exploited in the wild.

**How severe is CVE-2026-105174?** Medium severity, with a CVSS score of 5.4, published 5 October 2026.

**Which products and versions are affected?** Gerapy up to 0.9.13.

**Is there a fix for CVE-2026-105174?** Yes: fixed in Fixed in commit 6e481078cfba6388a67ca2d9792288405019ba3e (version details not specified in advisory). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105174 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105174?** Check whether you run Gerapy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Fixed in commit 6e481078cfba6388a67ca2d9792288405019ba3e (version details not specified in advisory)

## Technical details

The vulnerability exists in the project_create function in gerapy/server/core/views.py, where the project_name argument is not properly sanitized before being used in file path operations. An attacker can craft a malicious project name containing path traversal sequences (e.g., "../") to write files to arbitrary locations on the filesystem. The attack requires remote network access but does not require prior authentication based on the advisory description.

## Affected products

- Gerapy Gerapy up to 0.9.13

## Timeline

- 2026-10-05: disclosed
- 2026-10-05: patched: Patch commit 6e481078cfba6388a67ca2d9792288405019ba3e

## References

- [https://github.com/Gerapy/Gerapy/](https://github.com/Gerapy/Gerapy/)
- [https://github.com/Gerapy/Gerapy/commit/6e481078cfba6388a67ca2d9792288405019ba3e](https://github.com/Gerapy/Gerapy/commit/6e481078cfba6388a67ca2d9792288405019ba3e)

## Related threats

- [Gerapy missing authentication and Zip Slip in Project Upload Endpoint](https://junglewise.ai/threats/cve-2026-16209-gerapy-missing-authentication-and-zip-slip-in-project-upload)
- [PYSEC-2022-228 - An Access Control vunerabiity exists in Gerapy v 0.9.7 via the spider parameter in project_configure function.](https://junglewise.ai/threats/cve-2021-44597-gerapy-authorization-bypass-in-project-configure)