CVE-2026-114492 gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

What is CVE-2026-114492?

CVE-2026-114492 is a high-severity vulnerability in flipped-aurora gin-vue-admin, published on 21 Oct 2026.

Official description

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.

Weakness: CWE-22

Which versions are affected by CVE-2026-114492?

How do I fix CVE-2026-114492?

No fix has been published for CVE-2026-114492 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-114492 being exploited?

There is no known exploitation of CVE-2026-114492 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-mqv7-9mvf-h9fh, GHSA-qgwp-mwx4-c64g.