CVE-2026-114492

The gin-vue-admin framework (versions through 2.9.2 ) is vulnerable to a path traversal vulnerability in the /autoCode/removePlugin endpoint. An authenticated administrator can send a crafted POST request containing ../ sequences in the pluginName parameter, triggering the os.RemoveAll function. ...