CVE-2026-55224 MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
Attackers can exploit path traversal in MineAdmin to read files or execute commands via unsanitized plugin identifiers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55224?
CVE-2026-55224 is a high-severity path traversal vulnerability in MineAdmin, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences (e.g., ../) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands. This issue has been patched in version 3.2.0-alpha.2.
Weakness: CWE-22
Which versions are affected by CVE-2026-55224?
2 open source packages ship an affected version, including mineadmin/mineadmin.
| Package | Affected | Fixed in |
|---|---|---|
mineadmin/mineadmin Packagist | All versions | 3.2.0-alpha.2 |
mineadmin/mineadmin Packagist | All versions | 3.2.0-alpha.2 |
How do I fix CVE-2026-55224?
Upgrade mineadmin/mineadmin to 3.2.0-alpha.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55224 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55224 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-59xm-4m8c-g3xj.