CVE-2026-22786

🗓️ 12 Jan 2026 21:09:01Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 10 Views🌐 WEB

CVE-2026-22786: Path traversal enables arbitrary file upload in gin-vue-admin <=2.8.7 via breakpointContinueFinish.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2026-22786	11 Jan 202614:44	–	circl
CNNVD	Gin-vue-admin 代码问题漏洞	12 Jan 202600:00	–	cnnvd
Cvelist	CVE-2026-22786 Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal	12 Jan 202621:09	–	cvelist
EUVD	EUVD-2026-2000	13 Jan 202619:15	–	euvd
Github Security Blog	Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal	13 Jan 202619:15	–	github
NVD	CVE-2026-22786	12 Jan 202622:16	–	nvd
OSV	CVE-2026-22786 Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal	12 Jan 202621:09	–	osv
OSV	GHSA-3558-J79F-VVM6 Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal	13 Jan 202619:15	–	osv
OSV	GO-2026-4313 Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal in github.com/flipped-aurora/gin-vue-admin	23 Jan 202602:28	–	osv
OSV	SUSE-SU-2026:0292-1 Security update for govulncheck-vulndb	26 Jan 202611:11	–	osv

NVD

Vulners

Node

gin-vue-admin_project gin-vue-adminRange≤2.8.7

[
  {
    "vendor": "flipped-aurora",
    "product": "gin-vue-admin",
    "versions": [
      {
        "version": "<= 2.8.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-3558-j79f-vvm6
github	www.github.com/flipped-aurora/gin-vue-admin/commit/2242f5d6e133e96d1b359ac019bf54fa0e975dd5

Parameter	Position	Path	Description	CWE
fileName	request body	/fileUploadAndDownload/breakpointContinueFinish	Path traversal via breakpointContinueFinish endpoint allows uploading files to arbitrary directories by not validating fileName and concatenating with base path.	CWE-434, CWE-22

12 Mar 2026 19:04Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.2

CVSS 48.6

EPSS0.00655

SSVC