{"id":"CVE-2025-66410","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-66410","generatedAt":"2026-10-28T08:28:05.041Z","title":"In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources.","description":"Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder.","published":"2025-12-01T23:15:54.000Z","lastModified":"2026-10-18T18:10:00.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"4.0","score":8.7,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-22"],"affected":["gin-vue-admin project/gin-vue-admin"],"epss":{"score":0.00579,"percentile":0.47474,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/flipped-aurora/gin-vue-admin/commit/ee8d8d7e04d9c38a35a6969f20e75213e84f57c6","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-jrhg-82w2-vvj7","tags":["Exploit","Vendor Advisory"],"source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-66410","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}