A critical path traversal vulnerability (CVE-2026-55224, CVSS score of 8.7) exists in the plugin installation feature, allowing an attacker to read directory existence outside the plugin directory and potentially execute arbitrary code depending on the implementation of the affected function. The flaw occurs when the 'identifier' parameter is not properly validated or sanitized, enabling path traversal sequences that can lead to unauthorized access. This issue is particularly concerning when combined with missing PermissionMiddleware (GM-4340), as it allows any authenticated user to exploit this vulnerability. Affected versions include those prior to 3.2.0-alpha.2 of the mineadmin/mineadmin package. Path traversal enables reading directory existence outside the plugin directory, and Plugin::install with a traversed identifier may run composer commands on arbitrary directories. This could lead to arbitrary code execution depending on the implementation of Plugin::install. To remediate this issue, it is essential to validate and sanitize the 'identifier' parameter to reject path traversal sequences by using basename or a strict regex allowlist (e.g., ^[a-zA-Z0-9_-]+$) before concatenating into file paths.
We recommend you to update mineadmin to version 3.2.0-alpha.2.[/subscribe_to_unlock_form]
A critical path traversal vulnerability (CVE-2026-55224, CVSS score of 8.7) exists in the plugin installation feature, allowing an attacker to read directory existence outside the plugin directory and potentially execute arbitrary code depending on the implementation of the affected function. The flaw occurs when the 'identifier' parameter is not properly validated or sanitized, enabling path traversal sequences that can lead to unauthorized access. This issue is particularly concerning when combined with missing PermissionMiddleware (GM-4340), as it allows any authenticated user to exploit this vulnerability. Affected versions include those prior to 3.2.0-alpha.2 of the mineadmin/mineadmin package. Path traversal enables reading directory existence outside the plugin directory, and Plugin::install with a traversed identifier may run composer commands on arbitrary directories. This could lead to arbitrary code execution depending on the implementation of Plugin::install. To remediate this issue, it is essential to validate and sanitize the 'identifier' parameter to reject path traversal sequences by using basename or a strict regex allowlist (e.g., ^[a-zA-Z0-9_-]+$) before concatenating into file paths.
We recommend you to update mineadmin to version 3.2.0-alpha.2.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]