CVE-2026-22786

Executive Summary

CVE-2026-22786 is a critical path traversal vulnerability in the Gin-vue-admin backstage management system, affecting versions up to and including v2.8.7. The flaw resides in the breakpoint resume upload functionality, specifically in the breakpoint_continue.go file. The MakeFile function accepts a fileName parameter via the /fileUploadAndDownload/breakpointContinueFinish API endpoint and concatenates it directly with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../). An attacker with file upload privileges can exploit this to write arbitrary files to any directory on the server, potentially leading to remote code execution, data exfiltration, or complete system compromise. The vulnerability has a CVSS score of 0.0 in the NVD data, but based on the technical details, it is assessed as critical with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No official patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability affects the Gin-vue-admin project, which is a Go-based backstage management system. The project is distributed via GitHub and potentially through Go module proxies. Users should verify the integrity of their Go module cache and ensure they are not using a vulnerable version. The lack of a patch means that supply chain security is a significant concern, as the vulnerable code may be incorporated into downstream projects or deployments.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker simply sends a crafted request.
• Privileges Required (PR): Low (L) – The attacker needs file upload privileges, which are typically granted to authenticated users.
• User Interaction (UI): None (N) – No user action is required beyond the attacker’s own actions.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Arbitrary file write can lead to reading sensitive files.
• Integrity (I): High (H) – Arbitrary file write can modify system files.
• Availability (A): High (H) – Arbitrary file write can overwrite critical files, causing denial of service.

Threat Level: Critical (9.0)

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the file upload functionality of Gin-vue-admin. The core issue is in the breakpoint_continue.go file, specifically in the MakeFile function. This function is called when the /fileUploadAndDownload/breakpointContinueFinish API endpoint is invoked. The endpoint expects a fileName parameter, which is used to construct the full file path by concatenating it with the base directory ./fileDir/. The concatenation is done without any sanitization or validation for path traversal sequences like ../.

For example, if an attacker sends a request with fileName set to ../../etc/passwd, the resulting path becomes ./fileDir/../../etc/passwd, which resolves to /etc/passwd on a Unix-like system. The os.OpenFile() function then opens or creates the file at that path, allowing the attacker to write arbitrary content to any location on the filesystem.

The vulnerable code snippet (conceptual):

func MakeFile(fileName string) error {
    baseDir := "./fileDir/"
    fullPath := baseDir + fileName
    file, err := os.OpenFile(fullPath, os.O_CREATE|os.O_WRONLY, 0644)
    if err != nil {
        return err
    }
    defer file.Close()
    // write content to file
    return nil
}

The fix would involve sanitizing the fileName parameter to remove or reject any path traversal sequences, such as ../ or ..\\, and ensuring that the final path is within the intended base directory.

Vulnerable vs. Patched Code

Vulnerable Code (v2.8.7 and earlier):

func MakeFile(fileName string) error {
    baseDir := "./fileDir/"
    fullPath := baseDir + fileName
    file, err := os.OpenFile(fullPath, os.O_CREATE|os.O_WRONLY, 0644)
    if err != nil {
        return err
    }
    defer file.Close()
    // write content to file
    return nil
}

Patched Code (hypothetical fix):

import "path/filepath"

func MakeFile(fileName string) error {
    baseDir := "./fileDir/"
    // Clean the fileName to remove any path traversal sequences
    cleanName := filepath.Clean(fileName)
    // Ensure the cleaned name does not contain any directory traversal
    if strings.Contains(cleanName, "..") {
        return errors.New("invalid file name")
    }
    fullPath := filepath.Join(baseDir, cleanName)
    // Ensure the final path is within the base directory
    absBase, _ := filepath.Abs(baseDir)
    absFull, _ := filepath.Abs(fullPath)
    if !strings.HasPrefix(absFull, absBase) {
        return errors.New("path traversal detected")
    }
    file, err := os.OpenFile(fullPath, os.O_CREATE|os.O_WRONLY, 0644)
    if err != nil {
        return err
    }
    defer file.Close()
    // write content to file
    return nil
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable instance of Gin-vue-admin v2.8.7 using Docker or a local Go environment.
2. Obtain valid credentials with file upload privileges (e.g., admin user).
3. Use a tool like curl or a custom script to send a crafted request.

Exploitation Steps:

1. Authenticate and obtain a session token.
2. Send a POST request to /fileUploadAndDownload/breakpointContinueFinish with a malicious fileName parameter.
3. Example request:

   curl -X POST \
     -H "Authorization: Bearer <token>" \
     -F "fileName=../../tmp/evil.txt" \
     -F "file=@/path/to/local/file" \
     http://target.com/fileUploadAndDownload/breakpointContinueFinish
   

4. The file will be written to /tmp/evil.txt on the server.
5. To achieve RCE, upload a web shell (e.g., a Go binary or a script) to a directory accessible via the web server.

Expected Outcome: Arbitrary file write leading to potential RCE or data exfiltration.

Blue Team

Detection Steps:

1. Monitor API logs for requests to /fileUploadAndDownload/breakpointContinueFinish with unusual fileName parameters containing ../ or ..\\.
2. Implement input validation on the server side to reject path traversal sequences.
3. Use file integrity monitoring (FIM) to detect unauthorized file writes outside the expected upload directory.
4. Restrict file upload privileges to only trusted users and enforce strict access controls.

Mitigation:

• Apply the hypothetical patch described above.
• Use a Web Application Firewall (WAF) to block requests with path traversal patterns.
• Regularly update Gin-vue-admin to the latest version once a patch is released.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /fileUploadAndDownload/breakpointContinueFinish with fileName containing ../ or ..\\.
  • Unusual file paths in the fileName parameter (e.g., /etc/passwd, /var/www/html/shell.php).
• File System IOCs:
  • Unexpected files in directories outside the intended upload folder (e.g., /tmp/, /etc/, /var/www/html/).
  • New or modified files with suspicious content (e.g., web shells, backdoors).
• Log IOCs:
  • Error logs from os.OpenFile indicating attempts to open files outside the base directory.
  • Access logs showing repeated requests to the vulnerable endpoint with path traversal patterns.

Detection Engineering

YARA Rule

rule CVE_2026_22786_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Gin-vue-admin breakpoint resume upload"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-22786"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/fileUploadAndDownload/breakpointContinueFinish"
    condition:
        $endpoint and ($traversal1 or $traversal2)
}

Sigma Rule

title: CVE-2026-22786 Path Traversal in Gin-vue-admin
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts in Gin-vue-admin breakpoint resume upload
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-22786
logsource:
    category: webserver
    product: gin
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/fileUploadAndDownload/breakpointContinueFinish'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of file names containing dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-22786 Path Traversal in Gin-vue-admin"; flow:to_server,established; content:"POST"; http_method; content:"/fileUploadAndDownload/breakpointContinueFinish"; http_uri; content:"../"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the breakpoint resume upload functionality if not required, or restrict access to trusted users only.
2. Patch: Apply the hypothetical patch that sanitizes the fileName parameter using filepath.Clean() and validates that the final path is within the intended base directory.
3. Workaround: Implement a reverse proxy or WAF rule to block requests containing ../ or ..\\ in the fileName parameter.
4. Monitoring: Enable detailed logging for file upload operations and monitor for suspicious path traversal patterns.
5. Update: Once an official patch is released by the Gin-vue-admin maintainers, update to the patched version immediately.
6. Access Control: Review and restrict file upload privileges to only necessary users, and enforce the principle of least privilege.

Valters IT
Securing Digital Frontiers