Executive brief
EasyAdminBundle, a popular administration panel for Symfony applications, contains security flaws in its Flag and Icon display components. If a developer uses these components to display data provided by users without proper validation, an attacker could view sensitive SVG files on the server or execute malicious scripts in the administrator's browser. This could lead to unauthorized access to information or the hijacking of administrative sessions.
Technical details
The vulnerability exists in the `Flag` and `Icon` Twig components of EasyAdminBundle. The `countryCode` property in the Flag component and the `name` property in the Icon component are used to construct filesystem paths for SVG files without proper normalization, allowing for path traversal (CWE-22) to disclose any `.svg` file on the host. Additionally, the Flag component contains a reflected XSS vulnerability (CWE-79) because it interpolates the raw `countryCode` value into a fallback SVG string when a file is not found, which is then rendered using the `|raw` filter. These issues are reachable if a third-party template passes unvalidated user input into these component properties. The vulnerabilities are patched in versions 4.29.10 and 5.0.10.
Affected products
- EasyCorp EasyAdminBundle >= 4.0.0, < 4.29.10
- EasyCorp EasyAdminBundle >= 5.0.0, < 5.0.10
Timeline
- 2026-05-27: disclosed
- 2026-07-01: advisory
- 2026-07-01: patched