Vulnerability · Published Jan 12, 2026 · Assigned by GitHub_M
CVE-2026-22786Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal
High 7.3
In plain English
A high-severity unrestricted file upload in gin-vue-admin from flipped-aurora. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Official description
Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpoint_continue.go file, the MakeFile function accepts a fileName parameter through the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../). An attacker with file upload privileges could exploit this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/flipped-aurora/gin-vue-admin | no fix listed | GHSA-3558-j79f-vvm6 |
| Go | github.com/flipped-aurora/gin-vue-admin | no fix listed | GO-2026-4313 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| flipped-aurora | gin-vue-admin | <= 2.8.7 |
Weakness: CWE-434, CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P