CVE-2026-16209: Gerapy Project Upload Endpoint views.py missing authentication
A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is bd4891c60315f17611a3b7a651ffe0fba7cfe71e. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gerapyto a version that resolves this vulnerability.Fixed in 0.9.13Patch bd4891c60315f17611a3b7a651ffe0fba7cfe71e - Compensating control
Restrict network access to the Gerapy Project Upload Endpoint (gerapy/server/core/views.py) to trusted clients/hosts, since the issue can be launched remotely when authentication is missing.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16209?
The severity of CVE-2026-16209 is rated high with a score of 7.3.
How do I fix CVE-2026-16209?
To fix CVE-2026-16209, implement authentication controls for the Project Upload Endpoint in Gerapy.
What type of attack is possible with CVE-2026-16209?
CVE-2026-16209 allows for unauthorized access due to missing authentication, which can be exploited remotely.
Which software versions are affected by CVE-2026-16209?
CVE-2026-16209 affects Gerapy versions up to 0.9.13.
What component is vulnerable in CVE-2026-16209?
The vulnerable component identified in CVE-2026-16209 is the Project Upload Endpoint in gerapy/server/core/views.py.