CVE-2022-47762
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.
Risk Assessment
An attacker could access files outside the intended directory, potentially leading to disclosure of sensitive information.
Recommendation
Update gin-vue-admin to version 2.5.5 or later.
Other vulnerabilities in gin-vue-admin
See all- CVE-2026-114492Medium
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
- CVE-2026-48787High
In version 2.9.1 of the gin-vue-admin platform, an authenticated attacker with access to the code-generation feature and MCP management interface can exploit this vulnerability by injecting attacker-controlled Go source code, leading to the execution of arbitrary operating system commands on the server.
Original NVD description (English source)
In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS