8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66410

CVE-2025-66410: Gin-vue-admin has an arbitrary file deletion vulnerability

Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66410

CVE-2025-66410:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/flipped-aurora/gin-vue-admin	go	< 0.9.1-0.20251201084432-ee8d8d7e04d9	0.9.1-0.20251201084432-ee8d8d7e04d9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by examining the provided vulnerability information, which included a description, a proof-of-concept (POC), and a link to a fixing commit. The commit URL was used with the get_commit_infos tool to retrieve the patch details. The patch showed modifications to the RemoveChunk function within the server/api/v1/example/exa_breakpoint_continue.go file. The vulnerability description and the POC clearly indicate that the fileMd5 parameter is the vector for a path traversal attack. The code of the RemoveChunk function confirms that it reads the fileMd5 from the user's request and passes it to a utility function utils.RemoveChunk for deletion, without any validation in the vulnerable version. The patch adds a path traversal check, which, despite appearing to check the wrong field (file.FilePath instead of file.FileMd5 as suggested by the POC), confirms that RemoveChunk is the function where the vulnerability is located and was intended to be fixed. Therefore, FileUploadAndDownloadApi.RemoveChunk is identified as the vulnerable function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.