File Upload Vulnerability in EasyAdmin for Symfony Applications
CVE-2026-54087

7.6HIGH

Key Information:

Vendor

Easycorp

Status
Easyadminbundle
Vendor
CVE Published:
14 September 2026

What is CVE-2026-54087?

The EasyAdmin component for Symfony applications is vulnerable to file upload issues that can allow an attacker to execute malicious HTML or SVG files. Affected versions from 5.0.0 to 5.0.13 contain a weakness in handling uploads via FileField and ImageField, enabling harmful scripts to run in the context of an authenticated administrator's session. This occurs when an attacker can upload files to the public directory without proper validation. The vulnerability does not allow PHP or PHTML execution due to restrictions in Symfony's extension handling, but the risk of exposing sensitive session information is significant. The issue has been addressed in version 5.0.13.

Affected Version(s)

EasyAdminBundle >= 5.0.0, < 5.0.13

References

https://github.com/EasyCorp/EasyAdminBundle/security/advi...
x_refsource_CONFIRM
https://github.com/EasyCorp/EasyAdminBundle/commit/8132b2...
x_refsource_MISC
https://github.com/EasyCorp/EasyAdminBundle/releases/tag/...
x_refsource_MISC

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.