{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mineadmin/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MineAdmin"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MineAdmin"],"content_html":"\u003cp\u003eMineAdmin versions prior to 3.2.0-alpha.2 are vulnerable to a path traversal vulnerability in the app-store plugin service, tracked as CVE-2026-55224. The vulnerability arises because the \u003ccode\u003eidentifier\u003c/code\u003e parameter in the \u003ccode\u003edownload\u003c/code\u003e, \u003ccode\u003einstall\u003c/code\u003e, and \u003ccode\u003eunInstall\u003c/code\u003e functions is concatenated directly into file system paths without adequate sanitization. An authenticated attacker can supply path traversal sequences, such as '../', to interact with directories outside the intended plugin storage location.\u003c/p\u003e\n\u003cp\u003eThe risk is exacerbated by the absence of proper authorization checks on the \u003ccode\u003eadmin/plugin/store\u003c/code\u003e endpoint, as noted in related security findings (GM-4340). Successful exploitation could allow attackers to verify the existence of sensitive directories, perform arbitrary plugin operations, or potentially trigger composer-based command execution if the underlying \u003ccode\u003ePlugin::install\u003c/code\u003e functionality processes directories under the attacker's control. Defending organizations should update to version 3.2.0-alpha.2 or higher immediately to address this flaw.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains a valid JWT token via an existing authentication session.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP POST request targeting the \u003ccode\u003eadmin/plugin/store/install\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eidentifier\u003c/code\u003e parameter is populated with traversal sequences (e.g., \u003ccode\u003e../../etc\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application logic at \u003ccode\u003eplugin/mine-admin/app-store/src/Service/Service.php\u003c/code\u003e fails to validate the input.\u003c/li\u003e\n\u003cli\u003eThe server resolves the traversed path to an arbitrary directory outside the \u003ccode\u003e/plugin/\u003c/code\u003e root.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ePlugin::install\u003c/code\u003e function is invoked with the attacker-controlled path.\u003c/li\u003e\n\u003cli\u003eThe application executes file operations or command-line instructions within the traversed target directory.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows authenticated users to read file system structures and potentially escalate privileges via arbitrary code execution if the \u003ccode\u003ePlugin::install\u003c/code\u003e mechanism can be forced to execute composer commands against malicious directories. This affects all deployments of MineAdmin prior to version 3.2.0-alpha.2.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch MineAdmin to version 3.2.0-alpha.2 or higher to remediate CVE-2026-55224.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for POST requests to \u003ccode\u003e/admin/plugin/store/\u003c/code\u003e containing directory traversal sequences like \u003ccode\u003e../\u003c/code\u003e or \u003ccode\u003e..\\\\\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect attempts to access arbitrary directories via the plugin install endpoint.\u003c/li\u003e\n\u003cli\u003eAudit access logs for any authenticated user activity targeting the plugin store management endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T20:57:14Z","date_published":"2026-08-18T20:57:14Z","id":"https://feed.craftedsignal.io/briefs/2026-08-mineadmin-traversal/","summary":"MineAdmin versions before 3.2.0-alpha.2 contain a path traversal vulnerability in the app-store plugin service allowing authenticated attackers to interact with arbitrary file system directories.","title":"MineAdmin Path Traversal in App Store Plugin Service","url":"https://feed.craftedsignal.io/briefs/2026-08-mineadmin-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - MineAdmin","version":"https://jsonfeed.org/version/1.1"}