CVE-2026-22786: Gin-Vue-Admin Project Gin-Vue-Admin

High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days.

Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpoint_continue.go file, the MakeFile function accepts a fileName parameter through the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../). An attacker with file upload privileges could exploit this vulnerability.

Affected products

• Gin-Vue-Admin Project Gin-Vue-Admin: up to and including 2.8.7

Published 2026-01-12. Last modified 2026-06-17.