CVE-2026-22786: Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal
Impact Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory.
Path traversal vulnerabilities occur when a web application accepts user-supplied file paths without proper validation, allowing attackers to access or write files outside the intended directory. In the breakpointcontinue.go file, the MakeFile function accepts a fileName parameter through the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../).
Notably, while the related makeFileContent function in the same file properly validates the fileName parameter by checking for .. sequences, the MakeFile function lacks this security control, indicating an inconsistent security implementation.
An attacker with file upload privileges (role ID 888 - super administrator) could exploit this vulnerability by:
First uploading file chunks through the /fileUploadAndDownload/breakpointContinue endpoint (which has proper validation)
Then calling the /fileUploadAndDownload/breakpointContinueFinish endpoint with a malicious fileName parameter containing path traversal sequences (e.g., ../../../tmp/malicious.txt)
This could lead to: Arbitrary file creation, application process, Configuration file overwriting, Potential Remote Code Execution......
POC 1. Use this endpoint to upload any files(include name or file types) <img width="1429" height="788" alt="ClipboardScreenshot1767755216" src="https://github.com/user-attachments/assets/516022d6-32af-4810-abd9-945cb0bc5ae5" />
2. Then, the filename parameter here uses ../ to traverse to an arbitrary path. <img width="1445" height="306" alt="ClipboardScreenshot1767755256" src="https://github.com/user-attachments/assets/577aa1c1-9b26-4082-b431-f9dac1cdc307" />
3. Proof <img width="837" height="843" alt="ClipboardScreenshot1767755312" src="https://github.com/user-attachments/assets/66f51049-8dc8-4c94-994e-a6d8bc1196a9" />
Patches Please wait for the latest patch
Other sources
Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpointcontinue.go file, the MakeFile function accepts a fileName parameter through the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../). An attacker with file upload privileges could exploit this vulnerability.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22786?
CVE-2026-22786 is classified as a critical vulnerability due to its potential for arbitrary file uploads through path traversal.
How do I fix CVE-2026-22786?
To remediate CVE-2026-22786, upgrade to Gin-vue-admin version 2.8.8 or later, which addresses the path traversal exploit.
What is the impact of CVE-2026-22786?
The impact of CVE-2026-22786 includes unauthorized access to upload files, which can lead to server compromise and data leakage.
Who is affected by CVE-2026-22786?
CVE-2026-22786 affects users of Gin-vue-admin versions up to and including 2.8.7.
Are there any known exploits for CVE-2026-22786?
Yes, there are known exploit techniques that take advantage of the path traversal vulnerability in CVE-2026-22786 to upload arbitrary files.