CVE-2022-39345

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vulnerable to path traversal, which leads to file upload vulnerabilities. Version 2.5.4 contains a patch for this issue. There are no workarounds aside from upgrading to a patched version.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22CWE-23

Affected software

No affected versions have been published.

Timeline

Published
Oct 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-393466.5Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names whCVE-2022-393475.7FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path CVE-2022-393485.4Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured CVE-2022-393495.5The Tasks.org Android app is an open-source app for to-do lists and reminders. The Tasks.org app uses the activity `ShareLinkActivity.kt` toCVE-2022-39355.4The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated usersCVE-2022-393505.4@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allowCVE-2022-393514.4Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior CVE-2022-393529.8OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authoriCVE-2022-393539.8xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not CVE-2022-393547.5SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the `is_static` paramCVE-2022-393559.8Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. On sites with Patreon login enabled, an improper authCVE-2022-393568.8Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can ente
CVE-2022-39345: High severity, CVSS 7.5 | Vulnix