CVE-2026-22786 Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal
Attackers with upload privileges can exploit path traversal in breakpoint resume uploads to write arbitrary files to any directory.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22786?
CVE-2026-22786 is a high-severity path traversal vulnerability in flipped-aurora gin-vue-admin, published on 12 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpoint_continue.go file, the MakeFile function accepts a fileName parameter through the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../). An attacker with file upload privileges could exploit this vulnerability.
Which versions are affected by CVE-2026-22786?
3 open source packages ship an affected version, including github.com/flipped-aurora/gin-vue-admin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/flipped-aurora/gin-vue-admin Go | All versions | None |
github.com/flipped-aurora/gin-vue-admin Go | All versions to 2.8.7 | None |
github.com/flipped-aurora/gin-vue-admin Go | All versions to 2.8.7 | None |
Products include Gin-Vue-Admin Project Gin-Vue-Admin.
How do I fix CVE-2026-22786?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-22786 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22786 exists.
Other vulnerabilities in flipped-aurora gin-vue-admin
- CVE-2022-39345 Gin-vue-admin arbitrary file upload vulnerability caused by path traversal
- CVE-2022-39305 Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type
- CVE-2021-44219 SQL injection in n/a
- CVE-2022-32176 Gin-vue-admin - Unrestricted File Upload
- CVE-2022-32177 Gin-vue-admin - Unrestricted File Upload
Sources
Also known as GHSA-3558-j79f-vvm6, GO-2026-4313.