CVE-2026-55224

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences (e.g., ../) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands. This issue has been patched in version 3.2.0-alpha.2.

• CWE-22

• https://github.com/mineadmin/MineAdmin/commit/ca41902a2a5422676227e5088f4cc1dec06044f1
• https://github.com/mineadmin/MineAdmin/pull/728
• https://github.com/mineadmin/MineAdmin/releases/tag/v3.2.0-alpha.2
• https://github.com/mineadmin/MineAdmin/security/advisories/GHSA-59xm-4m8c-g3xj
• https://github.com/mineadmin/MineAdmin/security/advisories/GHSA-59xm-4m8c-g3xj

Published

Sep 30, 2026

Last Modified

Oct 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55219Paymenter is a free and open-source webshop solution for man…5.3
• CVE-2026-5522IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains…6.7
• CVE-2026-55220Pimcore is an Open Source Data & Experience Management Platf…9.3
• CVE-2026-55221Boruta is a standalone authorization server that aims to imp…6.5
• CVE-2026-55222Isar is an integration system for automated root filesystem …5.1
• CVE-2026-55223c3p0 is a JDBC Connection pooling library. In versions prior…6.3
• CVE-2026-55225Strimzi provides a way to run an Apache Kafka cluster on Kub…8
• CVE-2026-55226Strimzi provides a way to run an Apache Kafka cluster on Kub…5.4
• CVE-2026-55227Weblate is a web-based localization tool. In versions prior …4.3
• CVE-2026-55228Weblate is a web-based continuous localization platform used…8.1
• CVE-2026-55229Gotenberg is a Docker-powered stateless API for PDF files. P…7.5
• CVE-2026-5523The Divi Form Builder plugin for WordPress is vulnerable to …8.8