# CVE-2026-16209: Gerapy missing authentication and Zip Slip in Project Upload Endpoint

Source: https://junglewise.ai/threats/cve-2026-16209-gerapy-missing-authentication-and-zip-slip-in-project-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-19. Updated: 2026-07-19  
License: CC BY 4.0 with a link back

CVE-2026-16209 · Severity: high · CVSS 7.3 · Published 2026-07-19

Gerapy, a distributed crawler management framework, contains a security vulnerability in its project upload feature. An unauthenticated remote attacker can upload malicious files to the server, potentially leading to unauthorized code execution and full system compromise. This flaw bypasses intended security controls, allowing anyone with network access to the management interface to interfere with operations or access sensitive data.

Technologies: [Gerapy](https://junglewise.ai/threats/technologies/gerapy). Vendors: [Gerapy](https://junglewise.ai/threats/vendors/gerapy).

## Quick answers

**Is CVE-2026-16209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16209 being exploited in the wild.

**How severe is CVE-2026-16209?** High severity, with a CVSS score of 7.3, published 19 July 2026.

**Which products and versions are affected?** Gerapy up to 0.9.13.

**Is there a fix for CVE-2026-16209?** A patch was published on 2026-07-04: Fix merged in GitHub pull request 319 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16209 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-16209?** Check whether you run Gerapy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Gerapy up to 0.9.13 involves missing authentication and improper path validation in the 'project_upload' endpoint within 'gerapy/server/core/views.py'. The '@permission_classes([IsAuthenticated])' decorator was commented out, allowing unauthenticated network access to the function. Furthermore, the endpoint used 'zip_ref.extractall()' on uploaded archives without validating entry names, enabling a 'Zip Slip' path traversal attack. A remote attacker can exploit these combined issues to upload a crafted ZIP file containing directory traversal sequences (e.g., ../../../), writing arbitrary files to the filesystem to achieve Remote Code Execution (RCE). A patch (commit bd4891c) has been released to re-enable authentication and implement path validation.

## Affected products

- Gerapy Gerapy up to 0.9.13

## Timeline

- 2026-07-04: patched: Fix merged in GitHub pull request 319
- 2026-07-19: advisory: NVD publication date

## References

- [https://github.com/Gerapy/Gerapy/](https://github.com/Gerapy/Gerapy/)
- [https://github.com/Gerapy/Gerapy/commit/bd4891c60315f17611a3b7a651ffe0fba7cfe71e](https://github.com/Gerapy/Gerapy/commit/bd4891c60315f17611a3b7a651ffe0fba7cfe71e)
- [https://github.com/Gerapy/Gerapy/issues/317](https://github.com/Gerapy/Gerapy/issues/317)
- [https://github.com/Gerapy/Gerapy/pull/319](https://github.com/Gerapy/Gerapy/pull/319)
- [https://vuldb.com/cve/CVE-2026-16209](https://vuldb.com/cve/CVE-2026-16209)
- [https://vuldb.com/submit/857926](https://vuldb.com/submit/857926)
- [https://vuldb.com/vuln/380025](https://vuldb.com/vuln/380025)

## Related threats

- [Gerapy path traversal in project creation](https://junglewise.ai/threats/cve-2026-105174-a-vulnerability-has-been-found-in-gerapy-up-to-0-9-13-this)
- [PYSEC-2022-228 - An Access Control vunerabiity exists in Gerapy v 0.9.7 via the spider parameter in project_configure function.](https://junglewise.ai/threats/cve-2021-44597-gerapy-authorization-bypass-in-project-configure)