CVE-2026-22786: High-Severity Path Traversal and Unrestricted File Upload in gin-vue-admin

CyberDefender 2 mins0
  • CVE ID: CVE-2026-22786
  • Published: January 12, 2026 (NVD entry updated January 13)
  • Severity: High (CVSS 4.0 base score ~7.3 as contributed by GitHub)
  • Affected Product: gin-vue-admin (an open-source backend/admin system built with Vue.js and Gin)
  • Affected Versions: ≤ v2.8.7

Vulnerability Details

  • Type: Path traversal leading to unrestricted file upload
  • Root Cause:
    The breakpoint resume upload feature (in breakpoint_continue.go) accepts a fileName parameter from the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with a base directory (./fileDir/) without sanitizing or validating for sequences like ../. This allows attackers to traverse directories and write files outside the intended path.
  • Weakness Enumerations:
    • CWE-22: Path Traversal
    • CWE-434: Unrestricted Upload of File with Dangerous Type

Impact

  • What an Attacker Can Do:
    An authenticated user with file upload privileges could exploit this to place arbitrary files anywhere on the filesystem that the application user can write to. This could include:
    • Overwriting configuration files
    • Uploading malicious scripts or backdoors
    • Potentially enabling remote code execution depending on environment/context
  • Access Requirements:
    The vulnerability requires privileges to upload files via the breakpoint resume API.

Mitigation & Recommendations

  • Update: Upgrade gin-vue-admin to a patched version once available (no official patch referenced yet at time of publishing)
  • Immediate Controls (if update delayed):
    • Sanitize/validate filename inputs to block directory traversal sequences (e.g., reject ../)
    • Restrict file uploads to safe directories with limited permissions
    • Limit upload privileges to trusted users
    • Use application-level security controls and monitoring for suspicious upload paths

CyberDefender