CVE-2026-22786: Gin-vue-admin Path Traversal Vulnerability

CVE-2026-22786 Overview

Gin-vue-admin is a backstage management system based on Vue and Gin. A path traversal vulnerability exists in Gin-vue-admin versions up to and including v2.8.7 within the breakpoint resume upload functionality. This vulnerability allows attackers with file upload privileges to upload arbitrary files to any directory on the server, potentially leading to remote code execution or complete system compromise.

Critical Impact

Authenticated attackers can exploit the path traversal vulnerability to upload malicious files (such as webshells) to arbitrary directories, potentially achieving remote code execution on the target server.

Affected Products

• Gin-vue-admin <= v2.8.7
• Systems using the breakpoint resume upload functionality via /fileUploadAndDownload/breakpointContinueFinish API endpoint

Discovery Timeline

• 2026-01-12 - CVE-2026-22786 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-22786

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The vulnerability resides in the breakpoint_continue.go file where the MakeFile function processes user-supplied fileName parameters from the /fileUploadAndDownload/breakpointContinueFinish API endpoint.

The core issue stems from insufficient input validation when constructing file paths. The vulnerable code directly concatenates user-controlled input with the base directory path (./fileDir/) using os.OpenFile() without sanitizing or validating the input for directory traversal sequences such as ../. This allows an authenticated attacker to escape the intended upload directory and write files to arbitrary locations on the filesystem.

Root Cause

The root cause is the absence of input validation for path traversal sequences in the fileName parameter before it is concatenated with the base directory path. When user input containing sequences like ../ is processed without sanitization, the resulting file path can reference directories outside the intended ./fileDir/ upload location. This is a classic case of improper input validation leading to path traversal exploitation.

Attack Vector

The attack requires network access and authenticated privileges (file upload permissions). An attacker can craft a malicious request to the /fileUploadAndDownload/breakpointContinueFinish endpoint with a fileName parameter containing directory traversal sequences. For example, a filename like ../../../etc/cron.d/malicious could allow writing files to system directories, while ../../../var/www/html/shell.php could place a webshell in a web-accessible location.

The security patch was released in version v2.8.8. Below is an excerpt from the commit that addresses the vulnerability:

 	}
 	response.OkWithMessage("文件变更成功", c)
 }

+// InitDictionary
+// @Tags      AutoCodePlugin
+// @Summary   打包插件
+// @Security  ApiKeyAuth
+// @accept    application/json
+// @Produce   application/json
+// @Success   200   {object}  response.Response{data=map[string]interface{},msg=string}  "打包插件成功"
+// @Router    /autoCode/initDictionary [post]
+func (a *AutoCodePluginApi) InitDictionary(c *gin.Context) {
+	var dictInfo request.InitDictionary
+	err := c.ShouldBindJSON(&dictInfo)
+	if err != nil {
+		response.FailWithMessage(err.Error(), c)
+		return
+	}
+	err = autoCodePluginService.InitDictionary(dictInfo)
+	if err != nil {
+		global.GVA_LOG.Error("创建初始化Dictionary失败!", zap.Error(err))
+		response.FailWithMessage("创建初始化Dictionary失败"+err.Error(), c)
+		return
+	}
+	response.OkWithMessage("文件变更成功", c)
+}

Source: GitHub Commit Update

Detection Methods for CVE-2026-22786

Indicators of Compromise

• HTTP requests to /fileUploadAndDownload/breakpointContinueFinish containing ../ or URL-encoded variants (%2e%2e%2f, %2e%2e/) in the fileName parameter
• Unexpected files appearing in directories outside of ./fileDir/ on the server
• Web server logs showing unusual file upload requests with path manipulation attempts
• New or modified files in sensitive system directories such as /etc/, /var/www/, or application configuration paths

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing path traversal sequences (../, ..\\, encoded variants)
• Monitor file system integrity on the server using tools like AIDE or Tripwire to detect unauthorized file modifications
• Configure application-level logging to capture all file upload requests and their parameters for forensic analysis
• Deploy network intrusion detection systems (IDS) with signatures for path traversal attack patterns

Monitoring Recommendations

• Enable verbose logging for the Gin-vue-admin application, particularly for the file upload module
• Set up real-time alerts for file creation events outside designated upload directories
• Monitor authenticated user sessions for anomalous file upload activity patterns
• Implement centralized log aggregation to correlate file upload requests with file system changes

How to Mitigate CVE-2026-22786

Immediate Actions Required

• Upgrade Gin-vue-admin to version v2.8.8 or later immediately
• Review server file systems for any unauthorized files that may have been uploaded through this vulnerability
• Audit application logs for signs of exploitation attempts against the /fileUploadAndDownload/breakpointContinueFinish endpoint
• Restrict file upload privileges to only essential users until the patch is applied

Patch Information

The vulnerability has been addressed in Gin-vue-admin version v2.8.8. The fix is available through the GitHub Commit Update. For complete details about this security issue, refer to the GitHub Security Advisory GHSA-3558.

Workarounds

• Implement input validation at the reverse proxy or WAF level to strip path traversal sequences from file upload requests
• Temporarily disable the breakpoint resume upload functionality by restricting access to the /fileUploadAndDownload/breakpointContinueFinish endpoint
• Use container isolation or chroot environments to limit the impact of potential file writes outside intended directories

# Example: Nginx configuration to block path traversal attempts
location /fileUploadAndDownload/breakpointContinueFinish {
    # Block requests containing path traversal sequences
    if ($request_body ~* "\.\./") {
        return 403;
    }
    # Alternatively, restrict access until patched
    # deny all;
    proxy_pass http://gin-vue-admin-backend;
}