Path Traversal Vulnerability in Gin-Vue-Admin by Flipped-Aurora
CVE-2026-22786

7.3HIGH

Key Information:

Vendor

Flipped-aurora

Status
Gin-vue-admin
Vendor
CVE Published:
12 January 2026

What is CVE-2026-22786?

Gin-vue-admin, a management system developed by Flipped-Aurora, contains a vulnerability that allows an attacker to exploit the breakpoint resume upload feature. This flaw arises because the application does not properly validate file paths when handling uploads via the /fileUploadAndDownload/breakpointContinueFinish API endpoint. Specifically, the MakeFile function incorporates user-supplied file names directly into a base directory path, enabling attackers with sufficient privileges to upload files to arbitrary locations within the server's filesystem.

Affected Version(s)

gin-vue-admin <= 2.8.7

References

https://github.com/flipped-aurora/gin-vue-admin/security/...
x_refsource_CONFIRM
https://github.com/flipped-aurora/gin-vue-admin/commit/22...
x_refsource_MISC

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.