Live › vulnerability › CVE-2026-114492
Go to dashboardgin-vue-admin through 2.9.2 does not sanitize the pluginName parameter sent to /autoCode/removePlugin, so traversal sequences reach os.RemoveAll. An authenticated administrator can recursively delete any directory the server process can write to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running gin-vue-admin 2.9.2 or earlier with administrator accounts that can call the autoCode plugin endpoints. The flaw needs an authenticated administrator, so deployments where only trusted staff hold admin accounts carry less risk. unknown whether other versions or configurations are affected.
No product ranges from the sources yet.
2.9.2/autoCode/removePlugin route is reachable on your deployment2.9.2 once a patched release is published (sources do not name a fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
This page as .md · .json · in your agent: get_signal("CVE-2026-114492")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.