CVE-2026-55224: MineAdmin path traversal via unsanitized identifier in plugin operations

CVE-2026-55224 · Severity: high · CVSS 4 · Published 2026-09-30

MineAdmin's plugin management system fails to validate user-supplied plugin identifiers before using them in file path operations. An authenticated user can exploit this by injecting path traversal sequences (such as ../) to access plugin files outside the intended directory, potentially triggering installation or removal of software on arbitrary system paths. This could lead to unauthorized code execution or information disclosure depending on the underlying Plugin::install() implementation.

Technologies: mineadmin/mineadmin (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-55224 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55224 being exploited in the wild.
How severe is CVE-2026-55224?
High severity, with a CVSS score of 4, published 30 September 2026.
Which products and versions are affected?
Mineadmin < 3.2.0-alpha.2; mineadmin/mineadmin (Packagist) < 3.2.0-alpha.2, ECOSYSTEM:introduced=0,fixed=3.2.0-alpha.2.
Is there a fix for CVE-2026-55224?
Yes. mineadmin/mineadmin (Packagist): upgrade to 3.2.0-alpha.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55224 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55224?
Check whether you run Mineadmin or mineadmin/mineadmin (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mineadmin/mineadmin (Packagist): upgrade to 3.2.0-alpha.2 or later
    composer require mineadmin/mineadmin:^3.2.0-alpha.2

Technical details

The vulnerability exists in plugin/mine-admin/app-store/src/Service/Service.php where the download(), install(), and unInstall() methods concatenate the unsanitized `identifier` parameter directly into file system paths without validation (lines 32, 48, 70). The vulnerable code constructs paths like `BASE_PATH . '/plugin/' . $params['identifier']` where an attacker can include path traversal sequences such as `../` to access directories outside the plugin directory. The attack vector is network-accessible via HTTP POST endpoints protected only by AccessTokenMiddleware (JWT authentication), meaning any authenticated user can exploit it. The Plugin::install() and Plugin::unInstall() methods may trigger composer commands with the traversed path, potentially leading to arbitrary code execution. Patched versions 3.2.0-alpha.2 and later sanitize the identifier parameter using basename() or similar allowlist validation.

Affected products

  • MineAdmin MineAdmin < 3.2.0-alpha.2

Identifiers

  • CVE-2026-55224
  • GHSA-59xm-4m8c-g3xj

Timeline

  • 2026-06-11: disclosed
  • 2026-08-18: advisory: Published to GitHub Advisory Database
  • 2026-08-18: patched: Patch available in version 3.2.0-alpha.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.