CVE-2022-39345: flipped-aurora gin-vue-admin Path Traversal

Vulnerability summary

CVE-2022-39345 is a critical (CVSS 9.8) Path Traversal vulnerability in flipped-aurora gin-vue-admin. EPSS estimates a 1.44% chance of exploitation in the next 30 days, higher than 72.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-10-2022
   PublishedVulnerability first disclosed.
2. 22-04-2025
   Last modifiedVulnerability information updated.

Description

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
• CWE-23Relative Path TraversalThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.