# github.com/flipped-aurora/gin-vue-admin (Go) vulnerabilities

4 known vulnerabilities (4 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: v3.0.0+incompatible (Jul 17, 2026): affected by CVE-2026-22786
- Newest unaffected release: Every release is affected by at least one advisory
- Releases: 500+ since v2.5.0+incompatible (Feb 26, 2022)
- Registry: https://pkg.go.dev/github.com/flipped-aurora/gin-vue-admin
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-22786: v2.4.7-0.20220112024825-f53b12708f5f+incompatible to v3.0.1-0.20260829134158-3136500ef380+incompatible (through the newest release)
- CVE-2025-66410: no published release is affected
- CVE-2024-37896: v2.4.7-0.20220112024825-f53b12708f5f+incompatible to v2.6.6-0.20240611063344-725f6fe3ecce+incompatible (v2.6.6+incompatible is outside it)
- CVE-2022-47762: v2.4.7-0.20220112024825-f53b12708f5f+incompatible to v2.5.5-0.20221212064247-d81f58b5d6a4+incompatible (v2.5.5+incompatible is outside it)

Older releases aren't stored, so the earliest spans may start sooner.

## Advisories (4)

### [CVE-2026-22786](https://cve.now/CVE-2026-22786): Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal

- Severity: High 7.3
- Published: Jan 12, 2026
- Affected: all versions; through 2.8.7.
- No fix released. The latest release, v3.0.0+incompatible, is still affected.

### [CVE-2025-66410](https://cve.now/CVE-2025-66410): Gin-vue-admin has an arbitrary file deletion vulnerability

- Severity: High 8.7
- Published: Dec 1, 2025
- Affected: fixed in 0.9.1-0.20251201084432-ee8d8d7e04d9.
- Fixed in 0.9.1-0.20251201084432-ee8d8d7e04d9.
- The latest release, v3.0.0+incompatible, is not affected.

### [CVE-2024-37896](https://cve.now/CVE-2024-37896): SQL injection vulnerability in Gin-vue-admin

- Severity: High 8.8
- Published: Jun 17, 2024
- Affected: fixed in 2.6.6+incompatible.
- Fixed in v2.6.6+incompatible (released Jun 15, 2024, 2 days before disclosure).
- The latest release, v3.0.0+incompatible, is not affected.

### [CVE-2022-47762](https://cve.now/CVE-2022-47762): In gin-vue-admin \< 2.5.5, the download module has a Path Traversal vulnerability.

- Severity: High 7.5
- Published: Feb 3, 2023
- Affected: fixed in 2.5.5; fixed in 2.5.5+incompatible.
- Fixed in v2.5.5+incompatible (released Dec 14, 2022, 51 days before disclosure).
- The latest release, v3.0.0+incompatible, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/flipped-aurora/gin-vue-admin
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.