CVE-2026-50894

easyadmin 2.0.2.2 contains an unrestricted file upload flaw (CWE-434) in its background (admin) management interface that fails to restrict uploads to safe file types. An authenticated remote attacker can abuse the upload feature to place a crafted, dangerous-type file (such as a script or web shell) on the server, which is then executed server-side. Successful exploitation yields arbitrary code execution and escalation to server-level privileges, effectively a full compromise of the host running the application. Deployments of easyadmin 2.0.2.2 whose background management interface is reachable over the network are affected; note the CVSS 9.8 vector assumes no privileges required (PR:N) while the description states the attacker is authenticated, so there is some ambiguity about whether unauthenticated exploitation is possible. No public proof-of-concept, CISA KEV listing, or reported in-the-wild exploitation is known, and EPSS estimates roughly a 0.2% probability of exploitation within 30 days.

What to do: Inventory your environment for easyadmin 2.0.2.2 and restrict access to the background management interface via IP allowlisting, VPN, or strong authentication, since exploitation requires reaching that interface. Enforce strict upload handling as mitigation: extension/MIME allowlists, randomized filenames, storing uploads outside web-executable paths, and disabling script execution in upload directories. No fixed version is identified in the available data, so monitor vendor advisories for a patch and watch for PoC releases given the critical 9.8 severity.