PT-2026-2304 · Unknown · Gin-Vue-Admin

D0Ub1E-Dcoordinator · Published 2026-01-12 · Updated 2026-01-26 · CVE-2026-22786

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gin-vue-admin versions prior to 2.8.8

Description Gin-vue-admin, a backstage management system based on vue and gin, contains a path traversal issue in the breakpoint resume upload functionality. The vulnerability exists because the MakeFile function in the breakpoint continue.go file directly concatenates the fileName parameter with the base directory path (./fileDir/) using os.OpenFile() without proper validation for directory traversal sequences, such as ../. An attacker with file upload privileges can exploit this to upload arbitrary files to any directory. The vulnerable API endpoint is /fileUploadAndDownload/breakpointContinueFinish. The fileName parameter is vulnerable.

Recommendations Update Gin-vue-admin to version 2.8.8 or later.

Exploit

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

Related Identifiers

CVE-2026-22786

GHSA-3558-J79F-VVM6

GO-2026-4313

SUSE-SU-2026:0292-1

Affected Products

Gin-Vue-Admin

References · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22786.json · Exploit
• https://github.com/flipped-aurora/gin-vue-admin/commit/2242f5d6e133e96d1b359ac019bf54fa0e975dd5 · Patch
• https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-3558-j79f-vvm6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3558-j79f-vvm6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22786 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22786 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4313 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0292-1 · Vendor Advisory
• https://github.com/flipped-aurora/gin-vue-admin · Note
• https://suse.com/security/cve/CVE-2025-68388 · Note
• https://suse.com/security/cve/CVE-2026-23511 · Note
• https://suse.com/security/cve/CVE-2024-44905 · Note
• https://suse.com/security/cve/CVE-2017-18892 · Note
• https://suse.com/security/cve/CVE-2026-22868 · Note
• https://suse.com/security/cve/CVE-2026-23520 · Note