CVE-2026-105174— Gerapy Project Management views.py project_create path traversal
Quick assessment
Affected
n/a Gerapy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Gerapy 直至 0.9.13 版本中发现了一个漏洞。该漏洞影响组件“项目管理”中文件 gerapy/server/core/views.py 的 project_create 函数。对参数 project_name 的操作可导致路径遍历（Path Traversal）。远程利用该攻击是可能的。此漏洞的利用方法已公开，可能被滥用。修复该问题的补丁标识为 6e481078cfba6388a67ca2d9792288405019ba3e。建议应用此补丁以修复该问题。
Possible ATT&CK Techniques 3 AI
T1055 · Process Injection T1059 · Command and Scripting Interpreter T1059.004 · Unix Shell
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105174
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gerapy Project Management views.py project_create path traversal
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function project_create of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument project_name leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 6e481078cfba6388a67ca2d9792288405019ba3e. Applying a patch is the recommended action to fix this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Gerapy | 0.9.0 |
cpe:2.3:a:gerapy:gerapy:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-105174
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105174
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-105174 (1)
Vendor Advisories for CVE-2026-105174 (1)
Other References for CVE-2026-105174 (1)
Other References for CVE-2026-105174 (4)
-
https://vuldb.com/cve/CVE-2026-105174 third-party-advisory
-
-
https://vuldb.com/submit/970586 third-party-advisory
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-105180
Jeebase UserService info updateUser dynamically-determined o -
CVE-2026-105156
YzmCMS MD5 system.func.php password weak password hash -
CVE-2026-105149
mooSocial all-products sql injection -
CVE-2026-105144
Drogon Static File Router StaticFileRouter.cc route path tra -
CVE-2026-105137
Laradock Build Process Dockerfile code download
Same weakness: CWE-22
-
CVE-2026-105293
Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Han -
CVE-2026-105157
RainyGao DocSys Document Controller doGetTmpFile.do DocContr -
CVE-2026-105144
Drogon Static File Router StaticFileRouter.cc route path tra -
CVE-2026-105125
LaraDashboard before 1.4.8 Path Traversal via /api/translati -
CVE-2026-104983
Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_
V. Comments for CVE-2026-105174
No comments yet