EasyAdmin CVE-2026-54087
HIGH
GHSA-8559-gwj3-q37r
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
AC:H because exploitation needs non-default public-root upload storage plus a privilege gap; PR:L for the authenticated uploader; UI:R as an admin must open the file; S:C and C:H as script runs in the victim admin's session.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
EasyAdmin's FileField and ImageField accept browser-executable file types by default (FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG). When the upload directory is configured inside the public web root - as shown in the documentation - EasyAdmin links to the stored file inline (no download attribute or Content-Disposition: attachment).
An attacker with access to a form using these fields can upload an .html (FileField) or .svg (ImageField) file containing JavaScript. When another user opens it from the backend, it is served from the same origin and the script executes in the context of their authenticated admin session, enabling session/CSRF-token theft or privilege escalation.
Exploitation requires the developer to store uploads in the public directory and a privilege gap between the uploading user and the viewing administrator. This is stored XSS only - it does not allow remote code execution, because uploaded filenames are derived from Symfony's guessExtension(), which never produces .php/.phtml.
Credit
We would like to thank Emre Dogan for reporting the issue.
AnalysisAI
Stored cross-site scripting in EasyAdminBundle (Symfony admin generator) versions 5.0.0 through 5.0.12 allows a lower-privileged user with access to a form using FileField or ImageField to upload a browser-executable .html or .svg file that EasyAdmin then links to inline, executing attacker-controlled JavaScript in a viewing administrator's authenticated session. Impact includes session/CSRF-token theft and privilege escalation; it is explicitly NOT remote code execution because filenames come from Symfony's guessExtension(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete conditions all being true: (1) the application uses EasyAdmin's FileField or ImageField and the developer has configured the upload directory inside the public web root (the documented example configuration), so files are served inline from the backend origin; (2) an attacker holds an account with permission to submit a form containing one of these upload fields; and (3) a privilege gap exists - a more-privileged administrator later opens the uploaded file. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 score is 7.6 (High) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - network vector, low attacker privileges, but requiring user interaction (an admin opening the file) and a scope change (script runs in the victim admin's context). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged content editor uploads a malicious file named report.html (via FileField) or logo.svg (via ImageField) containing JavaScript that reads the admin session cookie or CSRF token. When a higher-privileged administrator later clicks the inline link to view that upload, the file is served same-origin as a top-level document and the script runs in the admin's authenticated session, exfiltrating tokens or performing privileged actions on their behalf. … |
| Remediation | Vendor-released patch: upgrade easycorp/easyadmin-bundle to 5.0.13 (composer require easycorp/easyadmin-bundle:^5.0.13), which forces a download for risky types (.html, .svg, .xhtml, .xml) by default; see the release at https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.0.13 and fix commit 8132b2b0ca3876c9261264fa267106a1b2c10a68. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments using EasyAdminBundle 5.0.0 through 5.0.12 and identify which administrative users have access to forms with FileField or ImageField components. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today