EasyAdmin's `FileField` and `ImageField` accept browser-executable file types by default (`FileField` applies no MIME/extension restrictions; `ImageField`'s default `Image` constraint accepts SVG). When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin links to the stored file inline (no download attribute or `Content-Disposition: attachment`). An attacker with access to a form using these fields can upload an `.html` (`FileField`) or `.svg` (`ImageField`) file containing JavaScript. When another user opens it from the backend, it is served from the same origin and the script executes in the context of their authenticated admin session, enabling session/CSRF-token theft or privilege escalation. Exploitation requires the developer to store uploads in the public directory and a privilege gap between the uploading user and the viewing administrator. This is stored XSS only — it does not allow remote code execution, because uploaded filenames are derived from Symfony's `guessExtension()`, which never produces `.php`/`.phtml`. Credit We would like to thank Emre Dogan for reporting the issue.
EasyAdmin's `FileField` and `ImageField` accept browser-executable file types by default (`FileField` applies no MIME/extension restrictions; `ImageField`'s default `Image` constraint accepts SVG). When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin links to the stored file inline (no download attribute or `Content-Disposition: attachment`). An attacker with access to a form using these fields can upload an `.html` (`FileField`) or `.svg` (`ImageField`) file containing JavaScript. When another user opens it from the backend, it is served from the same origin and the script executes in the context of their authenticated admin session, enabling session/CSRF-token theft or privilege escalation. Exploitation requires the developer to store uploads in the public directory and a privilege gap between the uploading user and the viewing administrator. This is stored XSS only — it does not allow remote code execution, because uploaded filenames are derived from Symfony's `guessExtension()`, which never produces `.php`/`.phtml`. Credit We would like to thank Emre Dogan for reporting the issue.
EasyAdmin's `FileField` and `ImageField` accept browser-executable file types by default (`FileField` applies no MIME/extension restrictions; `ImageField`'s default `Image` constraint accepts SVG). When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin links to the stored file inline (no download attribute or `Content-Disposition: attachment`). An attacker with access to a form using these fields can upload an `.html` (`FileField`) or `.svg` (`ImageField`) file containing JavaScript. When another user opens it from the backend, it is served from the same origin and the script executes in the context of their authenticated admin session, enabling session/CSRF-token theft or privilege escalation. Exploitation requires the developer to store uploads in the public directory and a privilege gap between the uploading user and the viewing administrator. This is stored XSS only — it does not allow remote code execution, because uploaded filenames are derived from Symfony's `guessExtension()`, which never produces `.php`/`.phtml`. Credit We would like to thank Emre Dogan for reporting the issue.
EasyAdmin's `FileField` and `ImageField` accept browser-executable file types by default (`FileField` applies no MIME/extension restrictions; `ImageField`'s default `Image` constraint accepts SVG). When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin links to the stored file inline (no download attribute or `Content-Disposition: attachment`). An attacker with access to a form using these fields can upload an `.html` (`FileField`) or `.svg` (`ImageField`) file containing JavaScript. When another user opens it from the backend, it is served from the same origin and the script executes in the context of their authenticated admin session, enabling session/CSRF-token theft or privilege escalation. Exploitation requires the developer to store uploads in the public directory and a privilege gap between the uploading user and the viewing administrator. This is stored XSS only — it does not allow remote code execution, because uploaded filenames are derived from Symfony's `guessExtension()`, which never produces `.php`/`.phtml`. Credit We would like to thank Emre Dogan for reporting the issue.
Update easycorp/easyadmin-bundle to 5.0.13 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanEasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField affects easycorp/easyadmin-bundle (composer). Severity is high. EasyAdmin's `FileField` and `ImageField` accept browser-executable file types by default (`FileField` applies no MIME/extension restrictions; `ImageField`'s default `Image` constraint accepts SVG). When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin links to the stored file inline (no download attribute or `Content-Disposition: attachment`). An attacker with access to a form using these fields can upload an `.html` (`FileField`) or `.svg` (`ImageField`) file containing JavaScript. When another user opens it from the backend, it is served from the same origin and the script executes in the context of their authenticated admin session, enabling session/CSRF-token theft or privilege escalation. Exploitation requires the developer to store uploads in the public directory and a privilege gap between the uploading user and the viewing administrator. This is stored XSS only — it does not allow remote code execution, because uploaded filenames are derived from Symfony's `guessExtension()`, which never produces `.php`/`.phtml`. Credit We would like to thank Emre Dogan for reporting the issue.
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| easycorp/easyadmin-bundlecomposer | >=5.0.0,<5.0.13 | 5.0.13 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate easycorp/easyadmin-bundle to 5.0.13 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanEasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField affects easycorp/easyadmin-bundle (composer). Severity is high. EasyAdmin's `FileField` and `ImageField` accept browser-executable file types by default (`FileField` applies no MIME/extension restrictions; `ImageField`'s default `Image` constraint accepts SVG). When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin links to the stored file inline (no download attribute or `Content-Disposition: attachment`). An attacker with access to a form using these fields can upload an `.html` (`FileField`) or `.svg` (`ImageField`) file containing JavaScript. When another user opens it from the backend, it is served from the same origin and the script executes in the context of their authenticated admin session, enabling session/CSRF-token theft or privilege escalation. Exploitation requires the developer to store uploads in the public directory and a privilege gap between the uploading user and the viewing administrator. This is stored XSS only — it does not allow remote code execution, because uploaded filenames are derived from Symfony's `guessExtension()`, which never produces `.php`/`.phtml`. Credit We would like to thank Emre Dogan for reporting the issue.
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| easycorp/easyadmin-bundlecomposer | >=5.0.0,<5.0.13 | 5.0.13 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard