PT-2026-2304 · Unknown · Gin-Vue-Admin

D0Ub1E-Dcoordinator · Publicado 2026-01-12 · Atualizado 2026-01-26 · CVE-2026-22786

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gin-vue-admin versions prior to 2.8.8

Description Gin-vue-admin, a backstage management system based on vue and gin, contains a path traversal issue in the breakpoint resume upload functionality. The vulnerability exists because the MakeFile function in the breakpoint continue.go file directly concatenates the fileName parameter with the base directory path (./fileDir/) using os.OpenFile() without proper validation for directory traversal sequences, such as ../. An attacker with file upload privileges can exploit this to upload arbitrary files to any directory. The vulnerable API endpoint is /fileUploadAndDownload/breakpointContinueFinish. The fileName parameter is vulnerable.

Recommendations Update Gin-vue-admin to version 2.8.8 or later.

Exploit

Correção

Unrestricted File Upload

Path traversal

Enumeração de Fraquezas

CWE-434

CWE-22

Identificadores relacionados

CVE-2026-22786

GHSA-3558-J79F-VVM6

GO-2026-4313

SUSE-SU-2026:0292-1

Produtos afetados

Gin-Vue-Admin

Referências · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22786.json · Exploit
• https://github.com/flipped-aurora/gin-vue-admin/commit/2242f5d6e133e96d1b359ac019bf54fa0e975dd5 · Correção
• https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-3558-j79f-vvm6 · Aviso do Fabricante
• https://github.com/flipped-aurora/gin-vue-admin · Nota
• https://suse.com/security/cve/CVE-2025-68388 · Nota
• https://suse.com/security/cve/CVE-2026-23511 · Nota
• https://suse.com/security/cve/CVE-2024-44905 · Nota
• https://suse.com/security/cve/CVE-2017-18892 · Nota
• https://osv.dev/vulnerability/GHSA-3558-j79f-vvm6 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-22868 · Nota
• https://suse.com/security/cve/CVE-2026-23520 · Nota
• https://suse.com/security/cve/CVE-2025-68383 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22786 · Nota de Segurança
• https://suse.com/security/cve/CVE-2026-22772 · Nota
• https://twitter.com/CVEnew/status/2010829913910022169 · Publicação no Twitter