What is the CVSS score of CVE-2026-54087?

CVE-2026-54087 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N.

Which versions of EasyAdmin are affected by CVE-2026-54087?

EasyAdminBundle versions 5.0.0 through 5.0.12 contain a stored cross-site scripting vulnerability allowing lower-privileged administrators to inject malicious code through file uploads, potentially…. A patch is available.

How to fix or mitigate CVE-2026-54087?

Within 24 hours, inventory all deployments using EasyAdminBundle 5.0.0 through 5.0.12 and identify which administrative users have access to forms with FileField or ImageField components. Within 7 days, begin upgrading affected instances to EasyAdminBundle 5.0.13 (vendor-released patch), or as an interim measure, restrict file upload form access to only trusted administrators and disable .html and .svg upload capability if immediate upgrade is not feasible. Complete the full upgrade to 5.0.13 or higher within 30 days and verify remediation by auditing Composer lockfiles across all applications to confirm no versions 5.0.0 through 5.0.12 remain in production.

EasyAdmin CVE-2026-54087

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-14 https://github.com/EasyCorp/EasyAdminBundle

GHSA-8559-gwj3-q37r

XSS Privilege Escalation PHP CSRF RCE

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

6.5 MEDIUM

AC:H because exploitation needs non-default public-root upload storage plus a privilege gap; PR:L for the authenticated uploader; UI:R as an admin must open the file; S:C and C:H as script runs in the victim admin's session.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 14, 2026 - 20:51 vuln.today

Analysis Generated

Jul 14, 2026 - 20:51 vuln.today

CVE Published

Jul 14, 2026 - 19:51 github-advisory

HIGH 7.6

DescriptionGitHub Advisory

EasyAdmin's FileField and ImageField accept browser-executable file types by default (FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG). When the upload directory is configured inside the public web root - as shown in the documentation - EasyAdmin links to the stored file inline (no download attribute or Content-Disposition: attachment).

An attacker with access to a form using these fields can upload an .html (FileField) or .svg (ImageField) file containing JavaScript. When another user opens it from the backend, it is served from the same origin and the script executes in the context of their authenticated admin session, enabling session/CSRF-token theft or privilege escalation.

Exploitation requires the developer to store uploads in the public directory and a privilege gap between the uploading user and the viewing administrator. This is stored XSS only - it does not allow remote code execution, because uploaded filenames are derived from Symfony's guessExtension(), which never produces .php/.phtml.

Credit

We would like to thank Emre Dogan for reporting the issue.

AnalysisAI

Stored cross-site scripting in EasyAdminBundle (Symfony admin generator) versions 5.0.0 through 5.0.12 allows a lower-privileged user with access to a form using FileField or ImageField to upload a browser-executable .html or .svg file that EasyAdmin then links to inline, executing attacker-controlled JavaScript in a viewing administrator's authenticated session. Impact includes session/CSRF-token theft and privilege escalation; it is explicitly NOT remote code execution because filenames come from Symfony's guessExtension(). There is no public exploit identified at time of analysis and it is not in CISA KEV; a vendor patch is available in 5.0.13.

Technical ContextAI

The affected component is the EasyAdminBundle (pkg:composer/easycorp/easyadmin-bundle), a widely used administration/back-office generator for the Symfony PHP framework. The root cause is CWE-79 (improper neutralization of input during web page generation): FileField applies no MIME/extension allow-list, and ImageField's default Image constraint accepts SVG, both of which are content types browsers render inline and can execute embedded JavaScript from. When uploads are stored under the public web root (as the documentation examples show), the web server serves them with a Content-Type matching their extension and EasyAdmin generates a same-origin link with no download attribute or Content-Disposition: attachment header, so opening the file loads it as a top-level document. The patch introduces a risky_inline_render form option (default false) that forces a download for dangerous types (.html, .svg, .xhtml, .xml) while leaving raster images, PDFs and office documents inline, with an opt-out allowRiskyInlineRender() method.

RemediationAI

Vendor-released patch: upgrade easycorp/easyadmin-bundle to 5.0.13 (composer require easycorp/easyadmin-bundle:^5.0.13), which forces a download for risky types (.html, .svg, .xhtml, .xml) by default; see the release at https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.0.13 and fix commit 8132b2b0ca3876c9261264fa267106a1b2c10a68. Do not enable allowRiskyInlineRender() unless uploads are restricted to trusted users, sanitized, or served from a separate domain. Because the download-forcing only protects EasyAdmin's own links (files opened by direct URL are still served as static assets), the vendor recommends stronger controls that also survive direct access: configure the web server to serve the upload directory with a Content-Disposition: attachment header, or store the upload directory outside the public web root entirely - the trade-off being that files can then only be delivered through an application-mediated route rather than as static assets. Serving uploads from a separate, cookieless origin also neutralizes session theft. Advisory: https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-8559-gwj3-q37r.