CVE-2026-105174

MEDIUM 5.4

Gerapy Project Management views.py project_create path traversal

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function project_create of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument project_name leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 6e481078cfba6388a67ca2d9792288405019ba3e. Applying a patch is the recommended action to fix this issue.

CWE	CWE-22
Vendor	n/a
Product	gerapy
Published	Oct 5, 2026

Stay Ahead of the Next One

Get instant alerts for n/a gerapy

Be the first to know when new medium vulnerabilities affecting n/a gerapy are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / Gerapy

0.9.0 0.9.1 0.9.2 0.9.3 0.9.4 0.9.5 0.9.6 0.9.7 0.9.8 0.9.9 0.9.10 0.9.11 0.9.12 0.9.13

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/413406 vuldb.com: https://vuldb.com/vuln/413406/cti vuldb.com: https://vuldb.com/cve/CVE-2026-105174 vuldb.com: https://vuldb.com/submit/970586 github.com: https://github.com/Gerapy/Gerapy/issues/317 github.com: https://github.com/Gerapy/Gerapy/pull/319 github.com: https://github.com/Gerapy/Gerapy/commit/6e481078cfba6388a67ca2d9792288405019ba3e github.com: https://github.com/Gerapy/Gerapy/

Credits

🔍 volksec (VulDB User)