Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck

CVE-2026-114492gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

Medium 6.5

In plain English

A medium-severity path traversal in gin-vue-admin from flipped-aurora. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 56.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.

Affected products (as reported)

Vendor	Product	Versions
flipped-aurora	gin-vue-admin	0 – through 2.9.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

References

GitHub Security Advisory (GHSA-mqv7-9mvf-h9fh) vendor-advisory
https://github.com/flipped-aurora/gin-vue-admin/blob/v2.9.2-stable/server/service/system/auto_code_plugin.go#L371-L390 technical-description
https://github.com/flipped-aurora/gin-vue-admin/blob/v2.9.2-stable/server/api/v1/system/auto_code_plugin.go#L209-L219 technical-description
VulnCheck Advisory: gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint third-party-advisory