Executive brief
EasyAdmin is a web application framework for rapid backend development. The admin panel allows authenticated administrators to upload files, but a configuration weakness permits them to add dangerous file types (like .php) to the upload allowlist without independent server-side restrictions. An authenticated attacker can exploit this to upload and execute malicious code on the server, potentially compromising the entire application and underlying infrastructure.
Technical details
The vulnerability is an unrestricted file upload of dangerous executable types in the EasyAdmin backend management interface. The root cause is insufficient validation: the upload configuration in app/admin/controller/system/Config.php allows administrators to modify permitted file extensions, and the upload handler in app/admin/controller/Ajax.php fails to enforce independent server-side restrictions against executable types like .php. An authenticated attacker with admin privileges can modify the upload config to whitelist .php, then POST a PHP file to /admin/ajax/upload with a spoofed MIME type (e.g., image/png); the server accepts it without verification. If the upload directory supports PHP execution, accessing the uploaded file via HTTP triggers arbitrary PHP code execution with web server privileges. No patch information is currently available.
Affected products
- zhongshaofa EasyAdmin 2.0.2.2
Timeline
- 2026-09-04: disclosed: Published on NVD
- 2026-09-01: other: Vulnerability reported on GitHub issue