Executive brief
MineAdmin's plugin management system fails to validate user-supplied plugin identifiers before using them in file path operations. An authenticated user can exploit this by injecting path traversal sequences (such as ../) to access plugin files outside the intended directory, potentially triggering installation or removal of software on arbitrary system paths. This could lead to unauthorized code execution or information disclosure depending on the underlying Plugin::install() implementation.
Technical details
The vulnerability exists in plugin/mine-admin/app-store/src/Service/Service.php where the download(), install(), and unInstall() methods concatenate the unsanitized `identifier` parameter directly into file system paths without validation (lines 32, 48, 70). The vulnerable code constructs paths like `BASE_PATH . '/plugin/' . $params['identifier']` where an attacker can include path traversal sequences such as `../` to access directories outside the plugin directory. The attack vector is network-accessible via HTTP POST endpoints protected only by AccessTokenMiddleware (JWT authentication), meaning any authenticated user can exploit it. The Plugin::install() and Plugin::unInstall() methods may trigger composer commands with the traversed path, potentially leading to arbitrary code execution. Patched versions 3.2.0-alpha.2 and later sanitize the identifier parameter using basename() or similar allowlist validation.
Affected products
- MineAdmin MineAdmin < 3.2.0-alpha.2
Timeline
- 2026-06-11: disclosed
- 2026-08-18: advisory: Published to GitHub Advisory Database
- 2026-08-18: patched: Patch available in version 3.2.0-alpha.2