Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/flipped-aurora/gin-vue-admin

4 known vulnerabilities (4 high), with the versions each affects and the releases that fix them.

Latest release
v3.0.0+incompatible (Jul 17, 2026): affected by CVE-2026-22786
Newest unaffected release
Every release is affected by at least one advisory
Advisories
4 · 4 high
Releases
500+ since v2.5.0+incompatible (Feb 26, 2022)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-22786
    Affects v2.4.7-0.20220112024825-f53b12708f5f+incompatible to v3.0.1-0.20260829134158-3136500ef380+incompatible (through the newest release)
  • CVE-2025-66410
    No published release is affected
    No published release is affected
  • CVE-2024-37896
    Affects v2.4.7-0.20220112024825-f53b12708f5f+incompatible to v2.6.6-0.20240611063344-725f6fe3ecce+incompatible (v2.6.6+incompatible is outside it)
  • CVE-2022-47762
    Affects v2.4.7-0.20220112024825-f53b12708f5f+incompatible to v2.5.5-0.20221212064247-d81f58b5d6a4+incompatible (v2.5.5+incompatible is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 4

  • Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal

    Affected: all versions; through 2.8.7.

    No fix released. The latest release, v3.0.0+incompatible, is still affected.

  • Gin-vue-admin has an arbitrary file deletion vulnerability

    Affected: fixed in 0.9.1-0.20251201084432-ee8d8d7e04d9.

    Fixed in 0.9.1-0.20251201084432-ee8d8d7e04d9.

    The latest release, v3.0.0+incompatible, is not affected.

  • SQL injection vulnerability in Gin-vue-admin

    Affected: fixed in 2.6.6+incompatible.

    Fixed in v2.6.6+incompatible (released Jun 15, 2024, 2 days before disclosure).

    The latest release, v3.0.0+incompatible, is not affected.

  • In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.

    Affected: fixed in 2.5.5; fixed in 2.5.5+incompatible.

    Fixed in v2.5.5+incompatible (released Dec 14, 2022, 51 days before disclosure).

    The latest release, v3.0.0+incompatible, is not affected.