CVE-2026-55224 MineAdmin - Path Traversal to Remote Code Execution

MineAdmin before 3.2.0-alpha.2 contains a path traversal vulnerability in the app-store plugin service where the identifier parameter is unsanitized in filesystem paths, allowing attackers to execute arbitrary code.

CVSS base score n/a
High
CISA KEV
Not listed
Public exploit
None known
Authentication
Not required
EPSS
1.15% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Path Traversal to Remote Code Execution
Impact
Remote Code Execution, Data Tampering
CVSS vector
N/A
Published
30 September 2026
Updated
15 October 2026
Weakness
CWE-22

Vendor fix

Upgrade MineAdmin to version 3.2.0-alpha.2 or later.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs