PT-2025-48577 · Unknown · Gin-Vue-Admin

Published 2025-12-01 · Updated 2026-02-06 · CVE-2025-66410

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gin-vue-admin versions prior to 2.8.6

Description Gin-vue-admin, a backstage management system based on vue and gin, is affected by a file deletion issue. Attackers can delete any file on the server, potentially causing damage or unavailability of server resources. This is achieved by manipulating the FileMd5 parameter.

Recommendations Update Gin-vue-admin to version 2.8.6 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-66410

GHSA-JRHG-82W2-VVJ7

GO-2025-4171

SUSE-SU-2025:4395-1

Affected Products

Gin-Vue-Admin

References · 49

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66410.json · Exploit
• https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-jrhg-82w2-vvj7 · Vendor Advisory
• https://github.com/flipped-aurora/gin-vue-admin/commit/ee8d8d7e04d9c38a35a6969f20e75213e84f57c6 · Patch
• https://osv.dev/vulnerability/GO-2025-4171 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66410 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:4395-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66410 · Vendor Advisory
• https://suse.com/security/cve/CVE-2017-18871 · Note
• https://suse.com/security/cve/CVE-2025-61729 · Note
• https://suse.com/security/cve/CVE-2025-64751 · Note
• https://suse.com/security/cve/CVE-2017-18883 · Note
• https://suse.com/security/cve/CVE-2018-21258 · Note
• https://suse.com/security/cve/CVE-2025-65111 · Note
• https://suse.com/security/cve/CVE-2025-44005 · Note
• https://suse.com/security/cve/CVE-2025-64761 · Note