CVE-2026-55224
HighCVSS 8.7Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
MineAdmin prior to version 3.2.0-alpha.2 has a vulnerability in the app-store plugin service where unsanitized identifiers are concatenated into file paths. An attacker can use path traversal sequences to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands.
Risk Assessment
An attacker can access sensitive files, change system configuration, or execute malicious commands, potentially leading to full system compromise.
Recommendation
Update MineAdmin to version 3.2.0-alpha.2 or later, which contains the security fix.
Other vulnerabilities in MineAdmin
Original NVD description (English source)
MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences (e.g., ../) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands. This issue has been patched in version 3.2.0-alpha.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS