Threat database

CVE-2026-22786 is a high-severity vulnerability in gin-vue-admin versions up to 2.8.7 that allows an attacker with file upload privileges to perform unrestricted file uploads via a path traversal flaw. The vulnerability exists in the breakpoint resume upload functionality where the filename parameter is concatenated directly with a base directory path without validation, enabling directory traversal attacks. Exploitation can lead to arbitrary file writes anywhere on the server filesystem, potentially resulting in code execution, data compromise, or service disruption. No user interaction or authentication bypass is required beyond having upload privileges. Although no known exploits are reported in the wild yet, the vulnerability's characteristics make it a significant risk for organizations using this software. European organizations relying on gin-vue-admin for backend management should prioritize patching or mitigating this issue to prevent potential attacks. Countries with higher adoption of gin-vue-admin or critical infrastructure using it are at greater risk. Immediate mitigation includes restricting file upload permissions, validating and sanitizing file paths, and monitoring for suspicious file activity.

Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder.

An issue in sanluan flipped-aurora gin-vue-admin 2.4.x allows an attacker to escalate privileges via the Session Expiration component.