CVE-2026-54087 in EasyAdminBundle
Summary
by MITRE • 09/14/2026
EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker with access to an affected form can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin when the file is opened from the backend. Exploitation requires a privilege gap between the uploader and viewer. The issue can expose session or CSRF tokens and enable privilege escalation, but does not permit PHP or PHTML code execution because Symfony guessExtension does not produce those stored extensions. This issue is fixed in version 5.0.13.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified within EasyAdmin versions ranging from 5.0.0 to 5.0.13 represents a significant security flaw rooted in improper handling of file uploads and subsequent content rendering, specifically affecting the FileField and ImageField components. This issue stems from a combination of insufficient input validation regarding allowed file types and inadequate output encoding or header configuration when serving stored files. The core technical failure lies in the template logic located at templates/crud/field/file.html.twig, which generates links to uploaded assets for inline rendering within the administrative interface. Crucially, these links lack the download attribute and do not enforce a Content-Disposition attachment header with an appropriate disposition type such as attachment or form-data. In web security architecture, this configuration dictates that browsers will attempt to render the content directly in the current context rather than forcing a file download, which is the standard secure practice for untrusted user-supplied files stored on a public-facing server.
The operational impact of this flaw becomes severe when uploaded files are persisted under the public web root directory, a common configuration for static assets and media libraries in Symfony applications. An attacker who possesses access to an affected form can exploit this by uploading malicious content disguised as valid file types. Specifically, while PHP or PHTML execution is prevented due to Symfony's guessExtension logic which filters out executable server-side script extensions, the system fails to adequately sanitize client-side executable formats such as HTML and SVG files containing JavaScript payloads. When a privileged administrator views these uploaded assets through the EasyAdmin interface, the browser interprets them according to their MIME type rather than treating them as opaque binary data. For an HTML file, this results in direct execution of embedded scripts within the context of the administrative application's origin. Similarly, SVG images can contain script elements that trigger JavaScript execution upon rendering.
This vulnerability facilitates a Stored Cross-Site Scripting attack vector where the malicious payload persists on the server and is executed by victims with higher privileges than the attacker. The exploitation requires a privilege gap between the user who uploads the file and the administrator or privileged user who views it, which aligns with common role-based access control scenarios in administrative panels. Once triggered, the executing JavaScript operates within the same-origin context of the EasyAdmin application. This allows the malicious script to interact directly with the Document Object Model and session storage mechanisms of the admin panel. The immediate consequences include the potential exfiltration of sensitive data such as authentication cookies, session tokens, or Cross-Site Request Forgery protection tokens stored in local storage or accessible via JavaScript APIs.
The security implications extend beyond simple data theft to encompass privilege escalation attacks. By stealing CSRF tokens or session identifiers, an attacker can impersonate a legitimate administrator account, bypassing access controls and gaining full control over the application's administrative functions. This could lead to further system compromise, including database manipulation, user management abuse, or integration with other backend services that trust the admin session. The vulnerability is classified under CWE-79 for Improper Neutralization of Input During Web Page Generation which covers Cross-site Scripting scenarios, and specifically relates to CWE-436 regarding Interpretation Conflict if different parsers are involved in validation versus rendering. From a tactical perspective within the MITRE ATT&CK framework, this behavior maps to T1059 Command and Control via Application Layer Protocol for initial access or data exfiltration, and potentially T1530 Data from Local System Retrieval if file system access is achieved through subsequent exploitation steps enabled by stolen credentials.
Mitigation strategies must address both the immediate technical flaw and broader security hygiene practices. The primary remediation involves upgrading to EasyAdmin version 5.0.13 or later, where this issue has been resolved by enforcing proper Content-Disposition headers that force browsers to treat uploaded files as downloads rather than inline content. For organizations unable to upgrade immediately, a temporary workaround includes configuring the web server to serve files from directories outside the public root if possible, thereby preventing direct browser access via URL manipulation. Alternatively, implementing strict MIME type validation on the server side and ensuring all file responses include headers that prevent execution of HTML or SVG scripts is critical. Security teams should also audit their Symfony configurations to ensure that guessExtension logic is supplemented with explicit allow-lists for acceptable image formats like PNG, JPEG, and GIF, explicitly excluding script-capable vector graphics unless strictly necessary and properly sanitized using dedicated libraries such as DOMPurify before any potential rendering occurs.