TI-2026-78928 Aliases CVE-2026-114492 GHSA-qgwp-mwx4-c64g

gin-vue-admin removePlugin Path Traversal Allows Directory Deletion

LOW 31CWE-22Published 2026-10-21 · Updated 2026-10-23

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

gin-vue-admin through 2.9.2 contains a path traversal flaw in which authenticated administrators can recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. The flaw is tracked as CWE-22, and a crafted POST request to the removePlugin endpoint causes the server to delete any directory writable by the server process. The CVSS 4.0 vector requires high privileges and no user interaction, and it shows high integrity and availability impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00511 43rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
flipped-aurora	gin-vue-admin	up to 2.9.2	—	No fix listed	CNA

gin-vue-admin Vendorflipped-aurora Affected up to 2.9.2 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:gin-vue-admin_project:gin-vue-admin::::::::	—	—	flipped-aurora

cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:* Versions — — ·flipped-aurora

Remediation

The sources list no fixed version for gin-vue-admin. Restrict access to the removePlugin endpoint to trusted administrators until a fix is available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-21 Threatist record created from CVE-2026-114492
2026-10-21 Alias added: GHSA-qgwp-mwx4-c64g
2026-10-23 Priority changed: MEDIUM → LOW
2026-10-23 CISA SSVC decision points changed

References

Advisory 1

GitHub Security Advisory (GHSA-mqv7-9mvf-h9fh)

Other 2

TI-2022-18720 Gin-vue-admin arbitrary file upload vulnerability caused by path traversal CVSS 3.1CRITICAL 9.8
TI-2022-18681 Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type CVSS 3.1CRITICAL 9.8
TI-2022-13903 Gin-vue-admin - Unrestricted File Upload CVSS 3.1CRITICAL 9.0
TI-2022-13902 Gin-vue-admin - Unrestricted File Upload CVSS 3.1CRITICAL 9.0
TI-2024-25212 SQL injection vulnerability in Gin-vue-admin CVSS 3.1HIGH 8.8
TI-2022-08656 SQL Injection in github.com/flipped-aurora/gin-vue-admin CVSS 3.1HIGH 8.8

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences