CVE-2022-39345

    Dashboard / Vulnerabilities / CVE-2022-39345

    CVE-2022-39345

    Published: 25 Oct 2022Last Modified: 28 Oct 2026

    Summary: Gin-vue-admin arbitrary file upload vulnerability caused by path traversal

    Details: Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.

    References: https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39345.json, https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-7gc4-r5jr-9hxv, https://nvd.nist.gov/vuln/detail/CVE-2022-39345, https://github.com/flipped-aurora/gin-vue-admin/issues/1263, https://github.com/flipped-aurora/gin-vue-admin/pull/1264

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -3ec4823533a1356b76eed5fc1a33432a77d97aea

    Affected versions

    v2.5.3b
    v2.5.3beta
    v2.5.3
    v2.5.2
    v2.5.1b
    v2.5.1
    v2.5.0a
    v2.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39345 | CVE-DB