CVE-2025-66410 is a path traversal in gin-vue-admin that lets an attacker delete any file or folder on the server by controlling the FileMd5 parameter. Versions 2.8.6 and earlier are affected. The record scores it 9.1 critical, and the advisory rates it High with no patched version listed.
What's affected
- Product: gin-vue-admin, a back office management system built on Vue and the Gin framework for Go.
- Affected: 2.8.6 and earlier (the advisory writes it as before 2.8.7).
- Fixed: the advisory lists patched versions as None and says to wait for the latest patch. The record links a fix commit, so check the project releases for a version that includes it.
- Interface: the advisory names the removeChunk endpoint under /api/fileUploadAndDownload.
Sources differ. The record scores 9.1 (critical) and its vector says no privileges are required. The advisory rates it High, and the example request it shows carries an authenticated session token. Assume a logged in user can do this, and treat it as possibly open to anyone until you have tested your own deployment.
How to check if you're exposed
Check which version you deployed.
git -C /path/to/gin-vue-admin describe --tags
grep -i "version" server/config.yaml web/package.json 2>/dev/null
If it is 2.8.6 or lower, you are affected. Then check whether the admin interface is reachable from outside your network, and how many accounts can reach the file upload and download feature.
What to do now
- Look at the project releases and the fix commit linked below, and upgrade or merge the fix as soon as a build is available. The advisory lists no patched version yet.
- Restrict the admin interface to a VPN or an allow list of addresses.
- Run the application as an unprivileged user that can only write to its own upload directory, so a deletion cannot reach configuration or system files.
- Back up configuration and data and verify you can restore them.
- Review application logs for requests to the chunk removal endpoint with unusual file hash values.
- Check your Go modules and front end packages too. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The class is CWE-22, path traversal. The server uses a value from the request to build a file system path to delete, and does not confine it to the intended folder. A value that climbs out of the folder reaches files elsewhere, such as configuration.
Deleting a configuration file or a directory can take a service down or change how it starts, which is why availability and integrity both rate high. The record does not list exploitation in the wild, and the CVE is not on CISA KEV.
Quick check
Is there a fixed release?
The advisory lists none and says to wait for the latest patch. A fix commit is linked from the record.
Do attackers need to log in?
The advisory example uses a logged in session, while the record vector says none is needed. Do not rely on authentication as protection.
Sources
Last reviewed: 18 October 2026.
