The risk is exacerbated by the absence of proper authorization checks on the admin/plugin/store endpoint, as noted in related security findings (GM-4340). Successful exploitation could allow attackers to verify the existence of sensitive directories, perform arbitrary plugin operations, or potentially trigger composer-based command execution if the underlying Plugin::install functionality processes directories under the attacker's control. Defending organizations should update to version 3.2.0-alpha.2 or higher immediately to address this flaw.

Attack Chain

1. Attacker obtains a valid JWT token via an existing authentication session.
2. Attacker crafts a malicious HTTP POST request targeting the admin/plugin/store/install endpoint.
3. The identifier parameter is populated with traversal sequences (e.g., ../../etc).
4. The application logic at plugin/mine-admin/app-store/src/Service/Service.php fails to validate the input.
5. The server resolves the traversed path to an arbitrary directory outside the /plugin/ root.
6. The Plugin::install function is invoked with the attacker-controlled path.
7. The application executes file operations or command-line instructions within the traversed target directory.

Impact

The vulnerability allows authenticated users to read file system structures and potentially escalate privileges via arbitrary code execution if the Plugin::install mechanism can be forced to execute composer commands against malicious directories. This affects all deployments of MineAdmin prior to version 3.2.0-alpha.2.

Recommendation

• Patch MineAdmin to version 3.2.0-alpha.2 or higher to remediate CVE-2026-55224.
• Monitor webserver logs for POST requests to /admin/plugin/store/ containing directory traversal sequences like ../ or ..\\.
• Deploy the Sigma rule below to detect attempts to access arbitrary directories via the plugin install endpoint.
• Audit access logs for any authenticated user activity targeting the plugin store management endpoints.