CVE-2025-66410
Critical · 9.1CVSS
9.1
EPSS
0.6%
Published
Dec 1, 2025
CISA due date
—
The record
Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/flipped-aurora/gin-vue-admin | 0 | 0.9.1-0.20251201084432-ee8d8d7e04d9 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0 | 0.0.20251209T172047-150000.1.127.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20251209T172047-150000.1.127.1 |
Related vulnerabilities
- GO-2026-4313 Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal in… Also affects github.com/flipped-aurora/gin-vue-admin
- CVE-2026-22786 Gin-vue-admin is a backstage management system based on vue and gin. Also affects github.com/flipped-aurora/gin-vue-admin
- CVE-2025-44005 An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner… Also affects govulncheck-vulndb
- CVE-2025-66564 Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Also affects govulncheck-vulndb
- CVE-2025-66506 Fulcio is a free-to-use certificate authority for issuing code signing certificates for… Also affects govulncheck-vulndb
- CVE-2025-66411 Coder allows organizations to provision remote development environments via Terraform. Also affects govulncheck-vulndb
- CVE-2025-66406 Step CA is an online certificate authority for secure, automated certificate management… Also affects govulncheck-vulndb
- CVE-2025-64443 MCP Gateway allows easy and secure running and deployment of MCP servers. Also affects govulncheck-vulndb