CVE-2026-54087

EasyAdmin, a widely used admin generator for Symfony, versions 5.0.0 through 5.0.12 allows FileField and ImageField to accept browser-executable uploads (HTML files and SVG images, respectively). Because the file.html.twig template links to stored files for inline same-origin rendering without a download attribute or a Content-Disposition: attachment header, JavaScript in an uploaded HTML or SVG file executes in the authenticated administrator's origin when the file is opened from the backend, provided uploads are stored under the public web root. Exploitation requires a privilege gap between the uploader and the viewer — for example, a low-privileged user uploading via a form that an administrator later previews — and can leak session or CSRF tokens and enable privilege escalation, though it does not allow PHP code execution since Symfony's guessExtension never stores .php/.phtml extensions. Sites running EasyAdmin 5.0.0–5.0.12 with uploads stored under the public web root are affected; the issue is fixed in 5.0.13. No public proof of concept or known in-the-wild exploitation has been reported, and the CVE is not on the CISA KEV list.

What to do: Upgrade EasyAdmin to 5.0.13 or later immediately. As defense in depth, configure uploads to be stored outside the public web root (or serve stored files with Content-Disposition: attachment / a forced download attribute), and restrict FileField/ImageField to safe MIME types. Also audit existing upload directories for HTML/SVG files that may have been planted to steal admin session or CSRF tokens, and review whether low-privileged users can reach any form backed by FileField or ImageField.