Gin Vue Admin
Monthly
Path traversal in gin-vue-admin through 2.9.2 allows an authenticated administrator to recursively delete arbitrary directories that are writable by the server process by supplying '../' sequences in the pluginName parameter of a POST request to /autoCode/removePlugin. The flaw is rated 7.0 (CVSS:4.0 AV:N/AC:L/PR:H, with high integrity and availability impact and no confidentiality impact); the independent assessment concurs with a 3.1 vector of AV:N/AC:L/PR:H/UI:N/I:H/A:H, so this is a moderate-priority, authentication-gated issue rather than a mass-exploitation threat. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the practical blast radius is bounded by the admin-level login requirement and by the filesystem permissions of the account under which the Gin server runs.
Authenticated remote code execution in gin-vue-admin 2.9.1 lets attackers with access to the code-generation and MCP management features inject arbitrary Go source via POST /autoCode/addFunc and trigger a rebuild/restart through POST /autoCode/mcpStart, yielding OS command execution as the application service account. No public exploit identified at time of analysis, and as of publication a patched version is not confirmed; the upstream GHSA-22cv-9jv2-6m62 advisory only documents allowlist-based workarounds.
Gin-vue-admin versions 2.8.7 and earlier contain a path traversal vulnerability in the breakpoint resume upload API that allows authenticated attackers to write arbitrary files to any directory on the system. Public exploit code exists for this vulnerability, which affects administrators and users with file upload privileges. An attacker can bypass directory restrictions by injecting traversal sequences (../) into the fileName parameter to escape the intended fileDir location.
Arbitrary file deletion in Gin-vue-admin 2.8.6 and earlier lets an authenticated user with a valid session token delete arbitrary files and folders on the server by supplying directory-traversal sequences in the fileMd5 parameter to /api/fileUploadAndDownload/removeChunk. Publicly available exploit code exists; no CISA KEV confirmation was provided, and EPSS is low at 0.12% (32nd percentile). The independent assessment rates this as a genuine but moderate-priority issue rather than an emergency.
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Gin-Vue-Admin before 2.4.6 mishandles a SQL database. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Path traversal in gin-vue-admin through 2.9.2 allows an authenticated administrator to recursively delete arbitrary directories that are writable by the server process by supplying '../' sequences in the pluginName parameter of a POST request to /autoCode/removePlugin. The flaw is rated 7.0 (CVSS:4.0 AV:N/AC:L/PR:H, with high integrity and availability impact and no confidentiality impact); the independent assessment concurs with a 3.1 vector of AV:N/AC:L/PR:H/UI:N/I:H/A:H, so this is a moderate-priority, authentication-gated issue rather than a mass-exploitation threat. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the practical blast radius is bounded by the admin-level login requirement and by the filesystem permissions of the account under which the Gin server runs.
Authenticated remote code execution in gin-vue-admin 2.9.1 lets attackers with access to the code-generation and MCP management features inject arbitrary Go source via POST /autoCode/addFunc and trigger a rebuild/restart through POST /autoCode/mcpStart, yielding OS command execution as the application service account. No public exploit identified at time of analysis, and as of publication a patched version is not confirmed; the upstream GHSA-22cv-9jv2-6m62 advisory only documents allowlist-based workarounds.
Gin-vue-admin versions 2.8.7 and earlier contain a path traversal vulnerability in the breakpoint resume upload API that allows authenticated attackers to write arbitrary files to any directory on the system. Public exploit code exists for this vulnerability, which affects administrators and users with file upload privileges. An attacker can bypass directory restrictions by injecting traversal sequences (../) into the fileName parameter to escape the intended fileDir location.
Arbitrary file deletion in Gin-vue-admin 2.8.6 and earlier lets an authenticated user with a valid session token delete arbitrary files and folders on the server by supplying directory-traversal sequences in the fileMd5 parameter to /api/fileUploadAndDownload/removeChunk. Publicly available exploit code exists; no CISA KEV confirmation was provided, and EPSS is low at 0.12% (32nd percentile). The independent assessment rates this as a genuine but moderate-priority issue rather than an emergency.
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Gin-Vue-Admin before 2.4.6 mishandles a SQL database. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.