Gin‑vue‑admin <= v2.8.7 contains a path traversal flaw in the breakpoint resume upload feature. The API endpoint /fileUploadAndDownload/breakpointContinueFinish passes a fileName value directly to os.OpenFile() by concatenating it to the base directory ./fileDir/ without validating directory‑traversal characters. This allows an attacker to write a file to any directory on the server, potentially including executable or configuration files, which may compromise the system or result in unauthorized modifications. The defect maps to CWE-22 (Path Traversal) and CWE-434 (Unrestricted Upload of File with Dangerous Type).

The affected product is the Gin‑vue‑admin project from flipped‑aurora. Versions up to and including 2.8.7 are impacted. No other vendor or product variants are listed in the CNA data.

The CVSS score of 7.3 indicates high severity, while the EPSS score of less than 1 % suggests that exploitation is uncommon but still possible, particularly where the API is exposed to non‑trusted parties. The vulnerability is not currently listed in CISA’s KEV catalog. An attacker would need access to the /fileUploadAndDownload/breakpointContinueFinish API with file‑upload privileges; the exploit does not require elevated permissions beyond those granted for successful uploads. Once exploited, the attacker could write arbitrary files onto the server filesystem, potentially affecting system operation or security.