CVE-2026-114492: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in flipped-aurora gin-vue-admin

CVE-2026-114492 describes a path traversal vulnerability in gin-vue-admin through version 2.9.2. Authenticated administrators can exploit this by sending a crafted POST request to the /autoCode/removePlugin endpoint with '../' sequences in the pluginName parameter. This input is not properly sanitized, allowing the os.RemoveAll function to recursively delete arbitrary directories writable by the server process, potentially leading to significant data loss or service disruption.

An attacker with administrator privileges can delete arbitrary directories on the server, potentially causing data loss and service disruption. The vulnerability requires authentication with high privileges but does not require user interaction. The CVSS 4.0 score is 7 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high privileges required.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access and monitor for suspicious POST requests to /autoCode/removePlugin. Avoid running the server process with excessive filesystem permissions to limit potential damage.