Executive brief
EasyAdmin, a popular administration panel for Symfony applications, contains a vulnerability in how it handles file and image uploads. If an application is configured to store these uploads in a publicly accessible folder, an attacker can upload malicious files (like HTML or SVG) containing hidden scripts. When an administrator views these files, the scripts execute in their browser, potentially allowing the attacker to steal session information or gain higher administrative privileges.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in EasyAdmin's FileField and ImageField components. By default, FileField lacks MIME/extension restrictions, and ImageField allows SVG files. When uploads are stored in the public web root, EasyAdmin serves these files inline without a 'download' attribute or 'Content-Disposition: attachment' header. An attacker with low-level access to a form can upload .html or .svg files containing malicious JavaScript. When an administrator views these files, the script executes within the context of their authenticated session, potentially leading to session theft or privilege escalation. The issue is addressed in version 5.0.13 by forcing downloads for risky file types.
Affected products
- EasyCorp EasyAdminBundle >= 5.0.0, < 5.0.13
Timeline
- 2026-06-04: patched: Version 5.0.13 released
- 2026-07-14: advisory: GitHub Advisory published
References
- https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-8559-gwj3-q37r
- https://github.com/EasyCorp/EasyAdminBundle/commit/8132b2b0ca3876c9261264fa267106a1b2c10a68
- https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.0.13
- https://api.github.com/repos/EasyCorp/EasyAdminBundle/security-advisories/GHSA-8559-gwj3-q37r