{"id":"CVE-2026-55224","title":"MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications","summary":"MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to versi…","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-22"],"vendor":"mineadmin","product":"MineAdmin","affected":["MineAdmin < 3.2.0-alpha.2"],"patched":["mineadmin/mineadmin 3.2.0-alpha.2"],"published":"2026-09-30","updated":"2026-10-02","sourceUpdated":"2026-10-02T17:17:06.293","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55224","references":[{"url":"https://github.com/mineadmin/MineAdmin/commit/ca41902a2a5422676227e5088f4cc1dec06044f1","label":"security-advisories@github.com"},{"url":"https://github.com/mineadmin/MineAdmin/pull/728","label":"security-advisories@github.com"},{"url":"https://github.com/mineadmin/MineAdmin/releases/tag/v3.2.0-alpha.2","label":"security-advisories@github.com"},{"url":"https://github.com/mineadmin/MineAdmin/security/advisories/GHSA-59xm-4m8c-g3xj","label":"security-advisories@github.com"},{"url":"https://github.com/mineadmin/MineAdmin/security/advisories/GHSA-59xm-4m8c-g3xj","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-59xm-4m8c-g3xj"}],"tags":["nvd","cve.org","exploit-available","ghsa","composer"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-02T16:27:53.095356Z"},"cvssSource":"cna","epss":0.01372,"epssPercentile":0.71805,"exploits":{"nuclei":["CVE-2026-55224"],"checkedAt":"2026-10-27T19:04:03.525Z"},"aliases":["GHSA-59xm-4m8c-g3xj"],"ecosystem":"composer","ingestedAt":"2026-08-18T21:23:00.103Z","slug":"CVE-2026-55224","body":"## Overview\n\nMineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences (e.g., ../) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands. This issue has been patched in version 3.2.0-alpha.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55224)\n\nAffected packages:\n\n- `mineadmin/mineadmin < 3.2.0-alpha.2`\n\nPatched in:\n\n- `mineadmin/mineadmin 3.2.0-alpha.2`\n\nSource: https://github.com/advisories/GHSA-59xm-4m8c-g3xj","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":47.8,"likelihood":0.3,"exploitation":12,"ransomware":0},"changes":[{"seq":213841,"id":"CVE-2026-55224","ts":1790792429815,"field":"cvss","old":null,"new":"8.7"},{"seq":5349,"id":"CVE-2026-55224","ts":1788887269823,"field":"exploit_available","old":"false","new":"true"},{"seq":4232,"id":"CVE-2026-55224","ts":1788886384690,"field":"exploit_available","old":"true","new":"false"},{"seq":2988,"id":"CVE-2026-55224","ts":1788883048353,"field":"exploit_available","old":"false","new":"true"},{"seq":2017,"id":"CVE-2026-55224","ts":1788882452767,"field":"exploit_available","old":"true","new":"false"},{"seq":1093,"id":"CVE-2026-55224","ts":1788881889631,"field":"exploit_available","old":"false","new":"true"}]}