Gin Vue Admin
Approved changes feed: RSS · Atom
cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Gin Vue Admin Project (5318dbfd-a71b-5a42-9c88-f20b5e3988fe) |
|---|---|
| Product | Gin Vue Admin (223905a0-9904-5808-86f6-61e879a19286) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/flipped-aurora/gin-vue-admin |
purl2cpe | 2026-06-01 10:18:15.321861 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-114492 |
vulnerable | 2026-11-03 10:15:53.973676 |
gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint
MEDIUM (6.5)
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
Published: 2026-10-21T17:54:16.906Z
Updated: 2026-10-23T15:09:41.469Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22786 |
vulnerable | 2026-06-08 07:51:13.917289 |
Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal
Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpoint_continue.go file, the MakeFile function accepts a fileName parameter through the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../). An attacker with file upload privileges could exploit this vulnerability.
Published: 2026-01-12T21:09:01.732Z
Updated: 2026-01-13T19:15:06.777Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66410 |
vulnerable | 2026-06-08 07:41:18.885568 |
Gin-vue-admin has an arbitrary file deletion vulnerability
Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder.
Published: 2025-12-01T22:28:59.982Z
Updated: 2025-12-02T14:12:10.529Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47762 |
vulnerable | 2026-06-08 05:50:40.891361 |
Details available
In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.
Published: 2023-02-03T00:00:00.000Z
Updated: 2025-03-26T18:31:48.439Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39345 |
vulnerable | 2026-06-08 05:47:18.629837 |
Gin-vue-admin arbitrary file upload vulnerability caused by path traversal
CRITICAL (9.8)
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.
Published: 2022-10-25T00:00:00.000Z
Updated: 2025-04-22T17:17:16.782Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-39305 |
vulnerable | 2026-06-08 05:47:18.576218 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-32177 |
vulnerable | 2026-06-08 05:44:42.655203 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-32176 |
vulnerable | 2026-06-08 05:44:42.654507 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24844 |
vulnerable | 2026-06-08 05:41:44.745854 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24843 |
vulnerable | 2026-06-08 05:41:44.745226 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21660 |
vulnerable | 2026-06-08 05:40:01.947886 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-44219 |
vulnerable | 2026-06-08 05:36:45.152462 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.