MineAdmin: Path traversal in app-store plugin install and uninstall
Summary
The app-store plugin service of MineAdmin uses user-supplied identifier values unsanitized in file system paths. An attacker can use path traversal sequences to read, install or uninstall plugins from arbitrary directories and may be able to run arbitrary Composer commands. Exploitation requires access to the affected endpoints, and the privilege level required is disputed between sources.
Affected
- MineAdmin (Composer package mineadmin/mineadmin) versions before 3.2.0-alpha.2
- Affected component: app-store plugin (admin/plugin/store endpoints)
Fixed in
- Version 3.2.0-alpha.2 (fix commit ca41902a2a5422676227e5088f4cc1dec06044f1, pull request #728)
Workaround
- No vendor workaround documented.
- Restrict access to the admin/plugin/store endpoints at the reverse proxy or WAF until the update is applied.
Exploitation
- Public GHSA and a technical analysis are available; a scanner template exists.
- CISA SSVC: exploitation status poc, automatable yes, technical impact partial.
- No reports of active exploitation in the wild found; CISA KEV not verified directly.
Our recommendation
- Check whether MineAdmin is installed and which version is running.
- Upgrade to 3.2.0-alpha.2 or later; verify the latest stable release on the releases page.
- Review the plugin directory and recent app-store activity for unexpected changes.
- Remove unneeded admin accounts and review access tokens.
- Prioritise internet-facing instances; treat exposed unpatched instances as possibly compromised until checked.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-59xm-4m8c-g3xj github.com
- Fix commit ca41902 github.com
- Pull request #728 github.com
- Release v3.2.0-alpha.2 github.com
- SecureLayer7 technical analysis securelayer7.net
- GitLab advisory database entry advisories.gitlab.com
- Vulnrichment (CISA SSVC) vulners.com
- CVE Security tracker cve-security.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:35.
Original description (NVD)
MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences (e.g., ../) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands. This issue has been patched in version 3.2.0-alpha.2.
NVD references (5)
- https://github.com/mineadmin/MineAdmin/commit/ca41902a2a5422676227e5088f4cc1dec06044f1
- https://github.com/mineadmin/MineAdmin/pull/728
- https://github.com/mineadmin/MineAdmin/releases/tag/v3.2.0-alpha.2
- https://github.com/mineadmin/MineAdmin/security/advisories/GHSA-59xm-4m8c-g3xj
- https://github.com/mineadmin/MineAdmin/security/advisories/GHSA-59xm-4m8c-g3xj
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.