Gin-vue-admin 存在由于 github.com/flipped-aurora/gin-vue-admin 中路径遍历导致的任意文件上传漏洞

The arbitrary file upload capability afforded by CVE-2026-22786 presents a significant risk. An attacker could upload a malicious web shell, granting them remote command execution on the server hosting the Gin-vue-admin application. This could lead to complete system compromise, data exfiltration, and further lateral movement within the network. The impact is amplified if the application is deployed in a production environment with sensitive data or critical functionality. Successful exploitation could also allow an attacker to overwrite existing system files, leading to denial of service.

Organizations using Gin-vue-admin in production environments, particularly those with sensitive data or critical applications, are at risk. Environments with weak file upload validation or inadequate access controls are especially vulnerable. Shared hosting environments where multiple users have upload capabilities also face increased risk.

• go / server:

find /var/log/gin-vue-admin -type f -name '*.log' -print0 | xargs -0 grep -i 'file upload'

• generic web:

curl -I <target_url>/upload | grep 'Content-Type'

1. 2026-01-23Disclosure

   disclosure

1. 已保留2026-01-09
2. 发布日期2026-01-23
3. 修改日期2026-03-03
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-22786 is to upgrade Gin-vue-admin to version 2.8.8 or later. If upgrading immediately is not feasible, implement temporary workarounds. Restrict the upload directory to a specific, isolated location. Thoroughly validate all uploaded filenames to prevent path traversal attempts, ensuring they do not contain characters like '..' or absolute paths. Consider implementing a Web Application Firewall (WAF) with rules to block suspicious file uploads. Monitor application logs for unusual file upload activity.