CVE-2026-55224

Name of the Vulnerable Software and Affected Versions MineAdmin versions prior to 3.2.0-alpha.2

Description The app-store plugin service fails to sanitize the identifier variable before concatenating it into file system paths. This allows an attacker to use path traversal sequences, such as ../, to read, install, or uninstall plugins from arbitrary directories. This issue occurs within the download(), install(), and unInstall() functions in the plugin/mine-admin/app-store/src/Service/Service.php file. Furthermore, the install() function may execute arbitrary composer commands on the traversed directories. The affected API endpoints include /admin/plugin/store/install, /admin/plugin/store/download, and /admin/plugin/store/uninstall.

Recommendations Update to version 3.2.0-alpha.2. As a temporary mitigation, restrict access to the identifier parameter in the app-store plugin service by implementing strict validation to reject path traversal sequences.