What is the CVSS score of CVE-2026-22786?

CVE-2026-22786 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Golang are affected by CVE-2026-22786?

Organizations using is a backstage management system based on vue and gin. Gin-vue-admin face moderate risk from CVE-2026-22786, a path traversal vulnerability rated CVSS 7.2.. A patch is available.

Is there a public PoC exploit available for CVE-2026-22786?

Yes, a public proof-of-concept exploit is available for CVE-2026-22786. Prioritise patching immediately. EPSS: 0.5%.

Golang CVE-2026-22786

Q: How to fix or mitigate CVE-2026-22786?

Within 7 days: Identify all affected systems running is a backstage management system based on vue and gin. Gin-v and apply vendor patches promptly. Review file handling controls and restrict upload directories.

HIGH

Path Traversal (CWE-22)

2026-01-12 security-advisories@github.com

GHSA-3558-j79f-vvm6

Path Traversal Golang Gin Vue Admin Suse

7.2

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Mar 12, 2026 - 19:04 vuln.today

Public exploit code

Patch released

Mar 12, 2026 - 19:04 nvd

Patch available

CVE Published

Jan 12, 2026 - 22:16 nvd

HIGH 7.2

DescriptionNVD

Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpoint_continue.go file, the MakeFile function accepts a fileName parameter through the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../). An attacker with file upload privileges could exploit this vulnerability.

AnalysisAI

Gin-vue-admin versions 2.8.7 and earlier contain a path traversal vulnerability in the breakpoint resume upload API that allows authenticated attackers to write arbitrary files to any directory on the system. Public exploit code exists for this vulnerability, which affects administrators and users with file upload privileges. …

RemediationAI

Within 7 days: Identify all affected systems running is a backstage management system based on vue and gin. Gin-v and apply vendor patches promptly. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

More from same product – last 7 days

CVE-2026-9256 HIGH This Week

8.1 May 22

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers

Vendor StatusVendor

CVE-2026-22786 vulnerability details – vuln.today

Back

Golang CVE-2026-22786

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

More from same product – last 7 days

Vendor StatusVendor

Share

External POC / Exploit Code