Is CVE-2026-54087 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54087 being exploited in the wild.

How severe is CVE-2026-54087?

High severity, with a CVSS score of 7.6, published 14 September 2026.

Which products and versions are affected?

EasyCorp EasyAdminBundle >= 5.0.0, = 5.0.0, < 5.0.13, ECOSYSTEM:introduced=5.0.0,fixed=5.0.13.

Is there a fix for CVE-2026-54087?

Yes. easycorp/easyadmin-bundle (Packagist): upgrade to 5.0.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54087 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54087?

Check whether you run EasyCorp EasyAdminBundle or easycorp/easyadmin-bundle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54087: EasyCorp EasyAdmin stored XSS in FileField and ImageField

Q: Is there a fix for CVE-2026-54087?

Yes. easycorp/easyadmin-bundle (Packagist): upgrade to 5.0.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54087 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54087?

Check whether you run EasyCorp EasyAdminBundle or easycorp/easyadmin-bundle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54087 · Severity: high · CVSS 7.6 · Published 2026-09-14

EasyAdmin, a popular administration panel for Symfony applications, contains a vulnerability in how it handles file and image uploads. If an application is configured to store these uploads in a publicly accessible folder, an attacker can upload malicious files (like HTML or SVG) containing hidden scripts. When an administrator views these files, the scripts execute in their browser, potentially allowing the attacker to steal session information or gain higher administrative privileges.

Technologies: EasyCorp EasyAdminBundle. Vendors: EasyCorp, Packagist.

Quick answers

Is CVE-2026-54087 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54087 being exploited in the wild.
How severe is CVE-2026-54087?: High severity, with a CVSS score of 7.6, published 14 September 2026.
Which products and versions are affected?: EasyCorp EasyAdminBundle >= 5.0.0, < 5.0.13; easycorp/easyadmin-bundle (Packagist) >= 5.0.0, < 5.0.13, ECOSYSTEM:introduced=5.0.0,fixed=5.0.13.
Is there a fix for CVE-2026-54087?: Yes. easycorp/easyadmin-bundle (Packagist): upgrade to 5.0.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54087 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54087?: Check whether you run EasyCorp EasyAdminBundle or easycorp/easyadmin-bundle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

easycorp/easyadmin-bundle (Packagist): upgrade to 5.0.13 or later
```
composer require easycorp/easyadmin-bundle:^5.0.13
```

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in EasyAdmin's FileField and ImageField components. By default, FileField lacks MIME/extension restrictions, and ImageField allows SVG files. When uploads are stored in the public web root, EasyAdmin serves these files inline without a 'download' attribute or 'Content-Disposition: attachment' header. An attacker with low-level access to a form can upload .html or .svg files containing malicious JavaScript. When an administrator views these files, the script executes within the context of their authenticated session, potentially leading to session theft or privilege escalation. The issue is addressed in version 5.0.13 by forcing downloads for risky file types.

Affected products

EasyCorp EasyAdminBundle >= 5.0.0, < 5.0.13

Identifiers

CVE-2026-54087
GHSA-8559-gwj3-q37r

Timeline

2026-06-04: patched: Version 5.0.13 released
2026-07-14: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.