---
id: CVE-2026-54087
title: EasyAdmin is a fast and modern admin generator for Symfony applications
summary: >-
  EasyAdmin is a fast and modern admin generator for Symfony applications. From
  5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable
  uploads while templates/crud/field/file.html.twig links to stored files for
  inline s…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N'
cwe:
  - CWE-79
  - CWE-434
vendor: EasyCorp
product: EasyAdminBundle
affected:
  - 'EasyAdminBundle >= 5.0.0, < 5.0.13'
patched:
  - easycorp/easyadmin-bundle 5.0.13
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T19:17:26.610'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54087'
references:
  - url: >-
      https://github.com/EasyCorp/EasyAdminBundle/commit/8132b2b0ca3876c9261264fa267106a1b2c10a68
    label: security-advisories@github.com
  - url: 'https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.0.13'
    label: security-advisories@github.com
  - url: >-
      https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-8559-gwj3-q37r
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-8559-gwj3-q37r'
tags:
  - nvd
  - cve.org
  - ghsa
  - composer
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T19:00:05.983563Z'
aliases:
  - GHSA-8559-gwj3-q37r
ecosystem: composer
ingestedAt: '2026-07-14T20:39:11.361Z'
epss: 0.00297
epssPercentile: 0.22653
---

## Overview

EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker with access to an affected form can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin when the file is opened from the backend. Exploitation requires a privilege gap between the uploader and viewer. The issue can expose session or CSRF tokens and enable privilege escalation, but does not permit PHP or PHTML code execution because Symfony guessExtension does not produce those stored extensions. This issue is fixed in version 5.0.13.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54087)

Affected packages:

- `easycorp/easyadmin-bundle >= 5.0.0, < 5.0.13`

Patched in:

- `easycorp/easyadmin-bundle 5.0.13`

Source: https://github.com/advisories/GHSA-8559-gwj3-q37r