MineAdmin Path Traversal in App Store Plugin Service

MineAdmin versions prior to 3.2.0-alpha.2 are vulnerable to a path traversal vulnerability in the app-store plugin service, tracked as CVE-2026-55224. The vulnerability arises because the identifier parameter in the download, install, and unInstall functions is concatenated directly into file system paths without adequate sanitization. An authenticated attacker can supply path traversal sequences, such as '../', to interact with directories outside the intended plugin storage location.

The risk is exacerbated by the absence of proper authorization checks on the admin/plugin/store endpoint, as noted in related security findings (GM-4340). Successful exploitation could allow attackers to verify the existence of sensitive directories, perform arbitrary plugin operations, or potentially trigger composer-based command execution if the underlying Plugin::install functionality processes directories under the attacker's control. Defending organizations should update to version 3.2.0-alpha.2 or higher immediately to address this flaw.

Attack Chain

1. Attacker obtains a valid JWT token via an existing authentication session.
2. Attacker crafts a malicious HTTP POST request targeting the admin/plugin/store/install endpoint.
3. The identifier parameter is populated with traversal sequences (e.g., ../../etc).
4. The application logic at plugin/mine-admin/app-store/src/Service/Service.php fails to validate the input.
5. The server resolves the traversed path to an arbitrary directory outside the /plugin/ root.
6. The Plugin::install function is invoked with the attacker-controlled path.
7. The application executes file operations or command-line instructions within the traversed target directory.

Impact

The vulnerability allows authenticated users to read file system structures and potentially escalate privileges via arbitrary code execution if the Plugin::install mechanism can be forced to execute composer commands against malicious directories. This affects all deployments of MineAdmin prior to version 3.2.0-alpha.2.

Recommendation

• Patch MineAdmin to version 3.2.0-alpha.2 or higher to remediate CVE-2026-55224.
• Monitor webserver logs for POST requests to /admin/plugin/store/ containing directory traversal sequences like ../ or ..\\.
• Deploy the Sigma rule below to detect attempts to access arbitrary directories via the plugin install endpoint.
• Audit access logs for any authenticated user activity targeting the plugin store management endpoints.