CVE-2022-39345 Gin-vue-admin arbitrary file upload vulnerability caused by path traversal
Attackers can exploit path traversal to upload arbitrary files, potentially leading to code execution or data modification in Gin-vue-admin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39345?
CVE-2022-39345 is a critical path traversal vulnerability in flipped-aurora gin-vue-admin, published on 25 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.
Which versions are affected by CVE-2022-39345?
2 open source packages ship an affected version, including github.com/flipped-aurora/gin-vue-admin/server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/flipped-aurora/gin-vue-admin/server Go | All versions | 2.5.4 |
github.com/flipped-aurora/gin-vue-admin/server Go | All versions | 2.5.4 |
Products include Gin-Vue-Admin Project Gin-Vue-Admin.
How do I fix CVE-2022-39345?
Upgrade github.com/flipped-aurora/gin-vue-admin/server to 2.5.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-39345 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39345 exists.
Other vulnerabilities in flipped-aurora gin-vue-admin
- CVE-2022-39305 Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type
- CVE-2021-44219 SQL injection in n/a
- CVE-2022-32176 Gin-vue-admin - Unrestricted File Upload
- CVE-2022-32177 Gin-vue-admin - Unrestricted File Upload
- CVE-2025-66410 Gin-vue-admin has an arbitrary file deletion vulnerability
Sources
Also known as GHSA-7gc4-r5jr-9hxv.