Threats Tagged 'cve-2026-22786'

CVE-2026-22786 is a high-severity vulnerability in gin-vue-admin versions up to 2.8.7 that allows an attacker with file upload privileges to perform unrestricted file uploads via a path traversal flaw. The vulnerability exists in the breakpoint resume upload functionality where the filename parameter is concatenated directly with a base directory path without validation, enabling directory traversal attacks. Exploitation can lead to arbitrary file writes anywhere on the server filesystem, potentially resulting in code execution, data compromise, or service disruption. No user interaction or authentication bypass is required beyond having upload privileges. Although no known exploits are reported in the wild yet, the vulnerability's characteristics make it a significant risk for organizations using this software. European organizations relying on gin-vue-admin for backend management should prioritize patching or mitigating this issue to prevent potential attacks. Countries with higher adoption of gin-vue-admin or critical infrastructure using it are at greater risk. Immediate mitigation includes restricting file upload permissions, validating and sanitizing file paths, and monitoring for suspicious file activity.

HighVulnerabilityGermanyFranceNetherlands+5#cve#cve-2026-22786#cwe-434