CVE-2026-54087: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in EasyCorp EasyAdminBundle
EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker with access to an affected form can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin when the file is opened from the backend. Exploitation requires a privilege gap between the uploader and viewer. The issue can expose session or CSRF tokens and enable privilege escalation, but does not permit PHP or PHTML code execution because Symfony guessExtension does not produce those stored extensions. This issue is fixed in version 5.0.13.
AI Analysis
Technical Summary
EasyAdminBundle versions >=5.0.0 and <5.0.13 contain an XSS vulnerability due to improper neutralization of input during web page generation. Specifically, FileField and ImageField accept uploads that can be rendered inline from the public web root without download attributes or content-disposition headers, allowing execution of attacker-supplied JavaScript in an administrator's browser context. Exploitation requires a privilege gap between the uploader and the viewer. The vulnerability can lead to exposure of session and CSRF tokens and privilege escalation but does not allow server-side code execution. The vulnerability is addressed in version 5.0.13.
Potential Impact
Successful exploitation allows an attacker with upload privileges to execute JavaScript in the context of an authenticated administrator, potentially exposing session and CSRF tokens and enabling privilege escalation within the application. However, it does not permit execution of server-side PHP or PHTML code.
Mitigation Recommendations
Upgrade EasyAdminBundle to version 5.0.13 or later, where this vulnerability is fixed. No other mitigations are specified or required.
CVE-2026-54087: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in EasyCorp EasyAdminBundle
Description
EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker with access to an affected form can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin when the file is opened from the backend. Exploitation requires a privilege gap between the uploader and viewer. The issue can expose session or CSRF tokens and enable privilege escalation, but does not permit PHP or PHTML code execution because Symfony guessExtension does not produce those stored extensions. This issue is fixed in version 5.0.13.
CVSS v3.1
Score 7.6high
Affected software
EasyCorp
EasyAdminBundle
pkg:github/easycorp/EasyAdminBundleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
EasyAdminBundle versions >=5.0.0 and <5.0.13 contain an XSS vulnerability due to improper neutralization of input during web page generation. Specifically, FileField and ImageField accept uploads that can be rendered inline from the public web root without download attributes or content-disposition headers, allowing execution of attacker-supplied JavaScript in an administrator's browser context. Exploitation requires a privilege gap between the uploader and the viewer. The vulnerability can lead to exposure of session and CSRF tokens and privilege escalation but does not allow server-side code execution. The vulnerability is addressed in version 5.0.13.
Potential Impact
Successful exploitation allows an attacker with upload privileges to execute JavaScript in the context of an authenticated administrator, potentially exposing session and CSRF tokens and enabling privilege escalation within the application. However, it does not permit execution of server-side PHP or PHTML code.
Mitigation Recommendations
Upgrade EasyAdminBundle to version 5.0.13 or later, where this vulnerability is fixed. No other mitigations are specified or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-11T18:44:47.761Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa8300255bf5e2cf5600a6d
Added to database: 09/14/2026, 17:33:54 UTC
Last enriched: 09/14/2026, 17:46:42 UTC
Last updated: 09/15/2026, 03:26:45 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.