GitHub Advisoryadvisory · Go

GHSA-3558-j79f-vvm6 Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal

HIGH Published 2026-01-13 Modified 2026-01-13 Official page ↗
Aliases
CVE-2026-22786
Ecosystem
Go
Packages
github.com/flipped-aurora/gin-vue-admin
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-22, CWE-434
Reviewed
2026-01-13

Affected packages

• Go github.com/flipped-aurora/gin-vue-admin: <= 2.8.7 (no fix yet)

Description

Impact Gin-vue-admin 2. Then, the `filename` parameter here uses `../` to traverse to an arbitrary path. 3. Proof Patches Please wait for the latest patch

Related

Alias · CVE (1)

  • CVE-2026-22786 Gin-vue-admin is a backstage management system based on vue and gin. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References