gin-vue-admin CVE-2026-114492

Exploitation requires an authenticated administrator session on gin-vue-admin and access to the automatic-code-generation plugin feature, specifically the /autoCode/removePlugin endpoint; the attacker supplies '../' traversal sequences in the pluginName parameter. The deletion is limited to directories that are writable by the server process's OS account, so impact scope depends on the server's filesystem permissions and privilege level. The principal limiting factors are the administrator-level authentication requirement (PR:H) and the fact that the destructive action is confined to the autoCode plugin-removal workflow; there is no confidentiality exposure and no unauthenticated path. Risk is highest where the admin panel is internet-exposed or where admin credentials are weakly protected.

This is a moderate-priority, authentication-gated vulnerability rather than a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) and the 7.0 score are driven by high integrity and availability impact (VC:N/VI:H/VA:H) - arbitrary recursive directory deletion - but gated behind PR:H, meaning the attacker must already hold administrator-level authentication in gin-vue-admin. No EPSS score was provided in the input, and the CVE is not listed in CISA KEV; no public exploit or POC is referenced. SSVC-style reasoning: exploitation status is 'none/no public exploit identified,' the flaw is likely automatable once an admin session exists, and technical impact is partial-to-total (destructive but not confidentiality-affecting). The signals are internally consistent - there is no conflict between the network attack vector and the described HTTP POST to /autoCode/removePlugin, and the PR:H requirement correctly matches the 'authenticated administrators' language in the description. The key caveat is that the real-world threat hinges entirely on how exposed and how trusted the admin panel is; for an attacker who already has admin rights, this is a straightforward destructive capability, but it does not enable initial access or privilege escalation on its own.

An attacker who has obtained administrator credentials (via phishing, credential reuse, or a compromised internal admin account) sends a crafted POST request to /autoCode/removePlugin with a pluginName value containing '../' traversal sequences. Because the server passes the value into os.RemoveAll without sanitization, the request recursively deletes a directory outside the plugin folder - any path writable by the server process - causing data loss or denial of service. No public exploit code is referenced, so exploitation currently requires manually crafting the request against a known admin session.