CVE-2026-114492— gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint
Quick assessment
Affected
flipped-aurora gin-vue-admin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
gin-vue-admin 2.9.2 及更早版本存在路径遍历漏洞。已认证的管理员可通过在 参数中提供路径遍历序列，递归删除任意目录。攻击者可向 接口发送包含 序列的伪造 POST 请求，触发 函数，从而删除服务器进程可写入的任何目录。
Possible ATT&CK Techniques 3 AI
T1485 · Data Destruction T1083 · File and Directory Discovery T1566 · PhishingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| flipped-aurora | gin-vue-admin | ≤ 2.9.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114492
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| flipped-aurora | gin-vue-admin | 0 ~ 2.9.2 | - |
|
II. Public POCs for CVE-2026-114492
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114492
请登录查看更多情报信息。
Other References for CVE-2026-114492 (4)
IV. Related Vulnerabilities
Same product: gin-vue-admin
-
CVE-2026-48787
gin-vue-admin vulnerable to RCE -
CVE-2026-22786
Gin-vue-admin has arbitrary file upload vulnerability caused -
CVE-2025-66410
Gin-vue-admin has an arbitrary file deletion vulnerability -
CVE-2024-37896
SQL injection vulnerability in Gin-vue-admin -
CVE-2024-31457
gin-vue-admin background arbitrary code coverage vulnerabili
Same vendor: flipped-aurora
-
CVE-2026-48787
gin-vue-admin vulnerable to RCE -
CVE-2026-22786
Gin-vue-admin has arbitrary file upload vulnerability caused -
CVE-2025-66410
Gin-vue-admin has an arbitrary file deletion vulnerability -
CVE-2024-37896
SQL injection vulnerability in Gin-vue-admin -
CVE-2024-31457
gin-vue-admin background arbitrary code coverage vulnerabili
Same weakness: CWE-22
-
CVE-2026-114140
nbconvert: File write via path traversal in cell output file -
CVE-2026-114377
leomoon-studios wiki-go Comment Deletion comments.go DeleteC -
CVE-2026-114376
leomoon-studios wiki-go API editor.go SourceHandler path tra -
CVE-2026-114375
leomoon-studios wiki-go Files Rename API files.go RenameFile -
CVE-2026-85518
Openscap: openscap: arbitrary file write via path traversal
V. Comments for CVE-2026-114492
No comments yet