🚨 CVE-2026–55224: Deep-Dive into MineAdmin Plugin Path Traversal to RCE

Managing backend architectures efficiently often requires modular administrative panels, and MineAdmin — built on the high-performance Hyperf PHP framework and Vue 3 — has become a popular choice for developers. However, recent security research revealed a critical vulnerability in MineAdmin versions prior to 3.2.0-alpha.2 that poses a severe threat to enterprise deployments. Tracked as CVE-2026–55224 (CVSS v3.1 Score: 7.5 High), this flaw allows authenticated attackers to execute a Path Traversal attack through the App-Store plugin management service, ultimately escalating into full Remote Code Execution (RCE).

How the Vulnerability Works

The flaw lies in how the backend processes plugin installation and uninstallation routines. When an administrator manages a plugin, the backend expects an identifier parameter. Due to missing input validation and sanitization, the application directly concatenates this user-supplied variable into local file system paths:

$pluginPath = BASE_PATH . '/plugins/' . $identifier;

$pluginPath = BASE_PATH . '/plugins/' . $identifier;

By supplying dot-dot-slash (../) sequences, an attacker can escape the restricted /plugins/ directory and reference arbitrary locations on the server. When combined with MineAdmin's internal plugin loading logic, the system can be coerced into triggering composer operations or autoloading arbitrary PHP classes, leading directly to RCE.

Remediation & Patching

To protect your infrastructure:

• Upgrade immediately to MineAdmin version 3.2.0-alpha.2 or higher.
• Enforce strict regex whitelisting (/^[a-zA-Z0-9_-]+$/) on input parameters.
• Utilize basename() and realpath() verification to ensure target paths remain locked within intended directory boundaries.

📖 Read the Full Technical Breakdown

For an in-depth analysis, including vulnerable vs. patched code comparisons, attack execution vectors, and complete mitigation steps, check out the full article on my website:

👉 Read the complete CVE-2026–55224 analysis on DenizHalil.com