The vulnerability is a path traversal flaw in the plugin install. Unsanitized identifier values are concatenated into file system paths, allowing an attacker who can supply arbitrary identifiers to read, install, or delete files outside the intended plugin area. The description states that an attacker can execute arbitrary composer commands; based on this, the potential for code execution is inferred. The weakness is identified as directory traversal (CWE‑22).

This flaw affects the MineAdmin backend management system prior to version 3.2.0‑alpha.2. The issue manifests when the app‑store plugin service processes user‑supplied identifiers without proper sanitization. Systems running any version older than the patched release are vulnerable.

The CVSS score of 8.7 indicates high severity. EPSS score of 1%, and the flaw is not listed in CISA KEV. The likely attack vector, based on the description, is that an attacker can exploit the flaw remotely through the web interface by submitting crafted identifier values to the plugin install/uninstall requests. Based on the description, a successful path traversal could allow the attacker to read or modify any file under the application directory and trigger composer commands, potentially leading to code execution. The vulnerability requires network access to the MineAdmin web console, but the description does not explicitly state authentication requirements, so that aspect is inferred.