flipped-aurora gin-vue-admin up to 2.8.7 API Endpoint breakpointContinueFinish OpenFile fileName unrestricted upload

Summaryinfo

A vulnerability marked as critical has been reported in flipped-aurora gin-vue-admin up to 2.8.7. The affected element is the function OpenFile of the file /fileUploadAndDownload/breakpointContinueFinish of the component API Endpoint. Performing a manipulation of the argument fileName results in unrestricted upload. This vulnerability was named CVE-2026-22786. The attack may be initiated remotely. There is no available exploit. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability classified as critical has been found in flipped-aurora gin-vue-admin up to 2.8.7. This affects the function OpenFile of the file /fileUploadAndDownload/breakpointContinueFinish of the component API Endpoint. The manipulation of the argument fileName with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpoint_continue.go file, the MakeFile function accepts a fileName parameter through the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../). An attacker with file upload privileges could exploit this vulnerability.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-22786 since 01/09/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1608.002 for this issue.

Applying the patch 2242f5d6e133e96d1b359ac019bf54fa0e975dd5 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-2000). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• flipped-aurora

Name

• gin-vue-admin

Version

• 2.8.0
• 2.8.1
• 2.8.2
• 2.8.3
• 2.8.4
• 2.8.5
• 2.8.6
• 2.8.7

License

• open-source

Website

• Product: https://github.com/flipped-aurora/gin-vue-admin/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion