CVE-2022-39345 CRITICAL

CVE-2022-39345: Gin-vue-admin arbitrary file upload vulnerability caused by path traversal

Vendor Flipped-Aurora
Product gin-vue-admin
Weakness CWE-22 · Path traversal
Published October 25, 2022
Last update April 22, 2025
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.

Key dates

02Disclosure timeline

October 25, 2022 CVE published
April 22, 2025 Record updated