CVE-2026-22786
Published: 12 January 2026
Summary
CVE-2026-22786 is a high-severity Path Traversal (CWE-22) vulnerability in Gin-Vue-Admin Project Gin-Vue-Admin. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-22786, published on 2026-01-12, is a path traversal vulnerability in Gin-vue-admin, a backstage management system based on Vue and Gin, affecting versions up to and including v2.8.7. The flaw exists in the breakpoint resume upload functionality, specifically the MakeFile function in breakpoint_continue.go. This function processes a fileName parameter from the /fileUploadAndDownload/breakpointContinueFinish API endpoint and concatenates it directly with the base directory path ./fileDir/ via os.OpenFile(), without validation against directory traversal sequences like ../.
An attacker with file upload privileges can exploit this vulnerability over the network with low complexity and no user interaction. Exploitation enables uploading arbitrary files to any server directory, potentially leading to unauthorized data access, modification, or deletion. The CVSS v3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), with associated CWEs CWE-22 (path traversal) and CWE-434.
Mitigation details are available in the GitHub security advisory at https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-3558-j79f-vvm6 and a related commit at https://github.com/flipped-aurora/gin-vue-admin/commit/2242f5d6e133e96d1b359ac019bf54fa0e975dd5, which addresses the issue in affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2000
Vulnerability details
Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpoint_continue.go file, the MakeFile function…
more
accepts a fileName parameter through the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../). An attacker with file upload privileges could exploit this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public web app upload endpoint directly enables T1190 exploitation and arbitrary file write for web shell deployment via T1505.003.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of untrusted input (fileName) to block path traversal sequences before os.OpenFile() writes to arbitrary directories.
Enforces that file-upload operations are confined to authorized paths only, preventing the traversal that allows writes outside ./fileDir/.
Can enforce information-flow rules that restrict file writes to the intended upload directory, blocking the unauthorized directory traversal flow.