VYPR
← All advisories
High severityNVD Advisory· Published Dec 1, 2025· Updated Dec 2, 2025

Gin-vue-admin has an arbitrary file deletion vulnerability

CVE-2025-66410

Description

Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/flipped-aurora/gin-vue-adminGo
< 0.9.1-0.20251201084432-ee8d8d7e04d90.9.1-0.20251201084432-ee8d8d7e04d9

Affected products

1

Patches

1
ee8d8d7e04d9

fix: 添加路径穿越拦截，禁止非法路径删除切片

https://github.com/flipped-aurora/gin-vue-adminpiexlMax(奇淼Dec 1, 2025via ghsa
commit
1 file changed · +5 −0
  • server/api/v1/example/exa_breakpoint_continue.go+5 −0 modified
    @@ -135,6 +135,11 @@ func (b *FileUploadAndDownloadApi) RemoveChunk(c *gin.Context) {
 		response.FailWithMessage(err.Error(), c)
 		return
 	}
+	// 路径穿越拦截
+	if strings.Contains(file.FilePath, "..") || strings.Contains(file.FilePath, "../") || strings.Contains(file.FilePath, "./") || strings.Contains(file.FilePath, ".\\") {
+		response.FailWithMessage("非法路径，禁止删除", c)
+		return
+	}
 	err = utils.RemoveChunk(file.FileMd5)
 	if err != nil {
 		global.GVA_LOG.Error("缓存切片删除失败!", zap.Error(err))

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.