CVE-2025-66410 Gin-vue-admin has an arbitrary file deletion vulnerability

What is CVE-2025-66410?

CVE-2025-66410 is a high-severity path traversal vulnerability in flipped-aurora gin-vue-admin, published on 1 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder.

Weakness: CWE-22

Which versions are affected by CVE-2025-66410?

3 open source packages ship an affected version, including github.com/flipped-aurora/gin-vue-admin. It affects 1 product.

Products include Gin-Vue-Admin Project Gin-Vue-Admin.

How do I fix CVE-2025-66410?

Upgrade github.com/flipped-aurora/gin-vue-admin to 0.9.1-0.20251201084432-ee8d8d7e04d9 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-66410 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66410 exists.

Other vulnerabilities in flipped-aurora gin-vue-admin

• CVE-2022-39345 Gin-vue-admin arbitrary file upload vulnerability caused by path traversal Critical 9.8
• CVE-2022-39305 Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type Critical 9.8
• CVE-2021-44219 SQL injection in n/a Critical 9.8
• CVE-2022-32176 Gin-vue-admin - Unrestricted File Upload Critical 9.0
• CVE-2022-32177 Gin-vue-admin - Unrestricted File Upload Critical 9.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jrhg-82w2-vvj7, GO-2025-4171.