Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.

Affected: Go: github.com/flipped-aurora/gin-vue-admin/server

### Impact Gin-vue-admin < 2.5.4 has File upload vulnerabilities。 File upload vulnerabilities are when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size. Failing to properly enforce restrictions on these could mean that even a basic image upload function can be used to upload arbitrary and potentially dangerous files instead. This could even include server-side script files that enable remote code execution.

### Patches

https://github.com/flipped-aurora/gin-vue-admin/pull/1264

### Workarounds

https://github.com/flipped-aurora/gin-vue-admin/pull/1264 ### References

#1263

### For more information The plugin installation function of Gin-Vue-Admin allows users to download zip packages from the plugin market and upload them for installation. This function has an arbitrary file upload vulnerability. A malicious attacker can upload a constructed zip package to traverse the directory and upload or overwrite arbitrary files on the server side.

The affected code https://github.com/flipped-aurora/gin-vue-admin/blob/main/server/service/system/sys_auto_code.go line 880 called the `utils.Unzip` method

``` paths, err := utils.Unzip(GVAPLUGPINATH+file.Filename, GVAPLUGPINATH) paths = filterFile(paths) var webIndex = -1 var serverIndex = -1 for i := range paths { paths[i] = filepath.ToSlash(paths[i]) pathArr := strings.Split(paths[i], "/") ln := len(pathArr) if ln < 2 { continue…