CVE-2026-114492
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
Risk Assessment
An authenticated administrator can accidentally or intentionally delete critical system directories, leading to data loss or service unavailability.
Recommendation
Update gin-vue-admin to a patched version or restrict administrative privileges and verify the validation of the pluginName parameter.
Other vulnerabilities in gin-vue-admin
See all- CVE-2026-48787High
In version 2.9.1 of the gin-vue-admin platform, an authenticated attacker with access to the code-generation feature and MCP management interface can exploit this vulnerability by injecting attacker-controlled Go source code, leading to the execution of arbitrary operating system commands on the server.
- CVE-2022-47762High
In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.
Original NVD description (English source)
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS