Critical · published December 2, 2025
⚡ A crafty parameter control lets attackers delete any file they want! In Gin-vue-admin versions 2.8.6 and earlier, it's like giving someone the keys to your server's filing cabinet without checking if they should have them. 🔥 Imagine a restaurant where a waiter can throw away any dish on the menu without asking. This vulnerability allows malicious actors to control the 'FileMd5' parameter, effectively deleting important server files as easily as tossing out your favorite meal without consent. The consequences could be absolutely devastating! An attacker could wipe out crucial files and folders, rendering your server unavailable and causing chaos in the system. This could lead to extended downtime, loss of data, and a huge headache in restoring everything back to normal.
Imagine a restaurant where a waiter can throw away any dish on the menu without asking. This vulnerability allows malicious actors to control the 'FileMd5' parameter, effectively deleting important server files as easily as tossing out your favorite meal without consent. This vulnerability in Gin-vue-admin allows attackers to manipulate the 'FileMd5' parameter, granting them the power to delete any file on the server at will. This results in significant damage and loss of server resources.
The consequences could be absolutely devastating! An attacker could wipe out crucial files and folders, rendering your server unavailable and causing chaos in the system. This could lead to extended downtime, loss of data, and a huge headache in restoring everything back to normal. To safeguard against this vulnerability, upgrade Gin-vue-admin to version 2.8.7 or later immediately. Additionally, implement strict validation and sanitization on the 'FileMd5' parameter to prevent unauthorized access. Regularly audit your server files to ensure nothing critical is missing. You've got this! With these steps, you'll be on your way to securing your server in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| gin-vue-admin_project/gin-vue-admin | ≤ 2.8.6 | — |