CVE-2026-114492

Deferred Deferred - Pending Action

Path Traversal in gin-vue-admin Leading to Directory Deletion

Publication date: 2026-10-21

Last updated on: 2026-10-23

Assigner: VulnCheck

Description

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114492

EUVD

EUVD-2026-107420

Affected Vendors & Products

Vendor	Product	Version / Range
flipped-aurora	gin-vue-admin	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-114492 is a path traversal vulnerability in gin-vue-admin versions up to 2.9.2. Authenticated administrators can exploit the removePlugin endpoint by sending a crafted POST request to /autoCode/removePlugin with '../' sequences in the pluginName parameter. This causes the server to recursively delete arbitrary directories writable by the server process using os.RemoveAll.

Detection Guidance

Check for suspicious POST requests to /autoCode/removePlugin with '../' sequences in the pluginName parameter. Monitor for unexpected directory deletions or file modifications in server directories. Review logs for unauthorized access to auto-code endpoints like initMenu, initAPI, or initDictionary.

Impact Analysis

This vulnerability allows attackers to delete critical files and directories on the server, potentially causing system crashes, data loss, or denial of service. It may also enable further attacks if combined with other vulnerabilities like code injection or XSS mentioned in the advisory.

Compliance Impact

This vulnerability can lead to unauthorized data deletion or modification, violating integrity and availability requirements in GDPR and HIPAA. It may result in non-compliance due to insufficient access controls and lack of protection against unauthorized file operations.

Mitigation Strategies

Upgrade to gin-vue-admin versions 2.9.3 or 3.0.1. Disable vulnerable endpoints if upgrading is not possible. Restrict access to auto-code endpoints and implement authentication. Validate plugin names to prevent path traversal. Monitor for unauthorized file operations.

Hi! I’m here to help you understand CVE-2026-114492. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...