Description
Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpoint_continue.go file, the MakeFile function accepts a fileName parameter through the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../). An attacker with file upload privileges could exploit this vulnerability.
INFO
Published Date :
2026-01-12T21:09:01.732Z
Last Modified :
2026-01-12T21:28:58.292Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-22786 vulnerability.
| Vendors | Products |
|---|---|
| Flipped-aurora |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-22786.
