MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences (e.g., ../) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands. This issue has been patched in version 3.2.0-alpha.2.

Affected: Packagist: mineadmin/mineadmin

## Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall

### Summary The app-store plugin service concatenates unsanitized user-supplied `identifier` values directly into file system paths. An attacker can use path traversal sequences (e.g., `../`) to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands.

### Vulnerable Code

**File:** `plugin/mine-admin/app-store/src/Service/Service.php`

```php // Line 32 - download(): path traversal via identifier public function download(array $params): bool { if (empty($params['identifier']) || empty($params['version'])) { $this->throwParamsFail(); } $service = make(AppStoreServiceImpl::class); if (! is_dir(BASE_PATH . '/plugin/' . $params['identifier'])) { // Path traversal $result = $service->download($params['identifier'], $params['version']); // ... } return true; }

// Line 48 - install(): path traversal + Plugin::install() with raw identifier public function install(array $params): bool { // ... $path = BASE_PATH . '/plugin/' . $params['identifier']; // Path traversal if (file_exists($path . '/install.lock')) { $this->throwAppInstalled(); } Plugin::install($params['identifier']); // May run composer commands with traversal path return true; }

// Line 70 - unInstall(): same pattern public function unInstall(array $params): bool { // ... $path = BASE_PATH . '/plug…