Gin-vue-admin CVE-2025-66410

Requires sending a request to the authenticated endpoint /api/fileUploadAndDownload/removeChunk; the public POC supplies a valid JWT (x-token for user 'admin'), indicating a valid application session is needed despite the supplied CVSS stating PR:N. The attacker must control the 'fileMd5' JSON parameter and inject directory-traversal sequences ('../') to escape the intended upload/chunk directory. Affects gin-vue-admin ≤ 2.8.6 in default configuration; the limiting factor is obtaining a valid session token, and the code path performs no path-traversal filtering prior to the fix. No special non-default feature toggle is required - the vulnerable chunk-removal handler is present by default.

This is a genuine but moderate-priority issue rather than an emergency. Signals are mixed: the vendor/GitHub CVSS 4.0 vector scores 8.7 (High) on the strength of AV:N/AC:L/PR:N/UI:N with VI:H, implying trivial remote unauthenticated integrity impact. However, the public POC contradicts PR:N - it includes a valid admin JWT (x-token) and targets an authenticated endpoint (/api/fileUploadAndDownload/removeChunk), strongly suggesting PR:L is more accurate; verify the actual auth requirement of removeChunk with the vendor. EPSS is low (0.12%, 32th percentile) and the CVE is NOT on CISA KEV, so there is no evidence of widespread or active exploitation despite public exploit code existing. The confirmed path-traversal root cause (the fix simply blocks '..'/'./' in FilePath) and working POC make exploitation reliable for anyone with the required access, but the low deployment footprint of this product and the authentication nuance keep real-world risk measured, not critical. Net: patch promptly in affected deployments, but this is not a drop-everything internet-wide threat.

An attacker with a valid application session (per the POC, an admin JWT) sends a crafted POST to /api/fileUploadAndDownload/removeChunk with a fileMd5 value containing directory-traversal sequences (e.g. '../config.yaml'). The server resolves the path without sanitization and deletes the targeted file or folder, allowing destruction of configuration, data, or application files and causing service disruption. Publicly available exploit code (the GHSA POC) demonstrates this against a default install.