CVE-2026-114492 in gin-vue-admin
Summary
by MITRE • 10/21/2026
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in gin-vue-admin versions through 2.9.2 represents a critical path traversal flaw within the application's plugin management subsystem. This security defect specifically affects authenticated administrators who possess the necessary privileges to interact with the autoCode module. The core of the issue lies in how the backend handles user-supplied input for the pluginName parameter during the removal process. Instead of validating or sanitizing this input against a whitelist of allowed characters or paths, the application directly passes the provided string into an operating system command execution function. This lack of rigorous input validation creates a direct vector for attackers to manipulate file system operations beyond their intended scope.
Technically, the vulnerability is triggered when an authenticated user sends a crafted POST request to the /autoCode/removePlugin endpoint. The server-side logic utilizes Go's os.RemoveAll function to delete directories associated with plugins. Because the pluginName parameter is not properly constrained, an attacker can inject directory traversal sequences such as ../ into this field. When processed by the operating system, these sequences resolve relative paths that escape the intended plugin directory structure. Consequently, instead of deleting only the specific plugin folder designated for removal, the os.RemoveAll function interprets the traversed path and proceeds to delete any directory on the file system that is writable by the user account running the server process. This behavior aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as the application fails to restrict access to files outside of the intended restricted location.
The operational impact of this vulnerability is severe and potentially catastrophic for system integrity. Since authenticated administrators can exploit this flaw to recursively delete arbitrary directories, an attacker with valid credentials could erase critical configuration files, database storage locations, or other essential application components. This capability effectively leads to a complete denial of service by rendering the application inoperable due to missing dependencies or data loss. Furthermore, if the server process runs with elevated privileges, such as root access, the impact extends beyond simple disruption; it could allow for further system compromise by deleting security logs, configuration files that control authentication mechanisms, or other sensitive infrastructure components. The ability to delete arbitrary directories undermines the fundamental principle of least privilege and compromises the availability and integrity aspects of the CIA triad.
To mitigate this vulnerability, immediate remediation is required at both the application code level and through operational controls. Developers must implement strict input validation for the pluginName parameter, ensuring that it only contains alphanumeric characters and does not include path traversal sequences or absolute paths. A more robust approach involves maintaining a whitelist of allowed plugins and resolving their file system locations internally rather than relying on user-supplied strings to determine deletion targets. Additionally, implementing canonicalization checks before processing any file operations can help detect and reject maliciously crafted inputs that attempt to escape the designated directory boundaries. From an operational standpoint, organizations should ensure that the gin-vue-admin service runs under a restricted user account with minimal permissions, limiting the potential damage even if such a vulnerability is exploited in other contexts. Upgrading to a patched version of gin-vue-admin where this issue has been resolved is the primary recommendation for affected deployments. This incident also highlights the importance of adhering to secure coding practices that prevent path traversal attacks, which are commonly categorized under ATT&CK techniques related to resource hijacking or impact actions involving data destruction.