This vulnerability is a path traversal flaw in gin‑vue‑admin up to version 2.9.2. An authenticated administrator can supply traversal sequences (e.g., '../') in the pluginName parameter when calling the /autoCode/removePlugin endpoint. The server then invokes os.RemoveAll, which recursively deletes any directory writable by the process, enabling arbitrary directory deletion and data loss.

The affected product is gin‑vue‑admin from flipped‑aurora, specifically all releases through version 2.9.2. Administrators of these installations are susceptible.

The CVSS score of 7 indicates high severity. The vulnerability requires authenticated administrator access and relies on a crafted POST request to a web endpoint, making it exploitable in environments where the application is available to privileged users. No EPSS data and the vulnerability is not listed in CISA KEV, but the high score and high privilege escalation potential warrant immediate attention.