CVE-2026-114492: gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated administrator can exploit it. The attacker must be able to send a crafted POST request to /autoCode/removePlugin with traversal sequences in the pluginName parameter.
What impact depends on the server environment?
The attacker can recursively delete arbitrary directories that are writable by the server process. The practical scope is therefore limited by that process's filesystem permissions.
How can I determine whether an installation is affected?
Installations of gin-vue-admin through version 2.9.2 are affected. Review access to the administrative removePlugin function and inspect requests to /autoCode/removePlugin for pluginName values containing ../ traversal sequences.