TI-2026-39016 Aliases CVE-2026-54087 GHSA-8559-gwj3-q37r

EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

LOW 33CWE-434Published 2026-09-14 · Updated 2026-09-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution, Cross-site scripting
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434 and CWE-79.

Summary

EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker with access to an affected form can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin when the file is opened from the backend. Exploitation requires a privilege gap between the uploader and viewer. The issue can expose session or CSRF tokens and enable privilege escalation, but does not permit PHP or PHTML code execution because Symfony guessExtension does not produce those stored extensions. This issue is fixed in version 5.0.13.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00404 34th percentileScored 2026-11-07

Fix Fixed EasyAdminBundle (EasyCorp): 5.0.13easycorp/easyadmin-bundle (Packagist): 5.0.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
EasyCorp	EasyAdminBundle	5.0.0 to before 5.0.13	5.0.13	Patch available	CNA
—	easycorp/easyadmin-bundle (Packagist)	5.0.0 to before 5.0.13	5.0.13	Patch available	GHSA-8559-gwj3-q37r

EasyAdminBundle VendorEasyCorp Affected 5.0.0 to before 5.0.13 Fixed in 5.0.13 Patch available CNA
easycorp/easyadmin-bundle (Packagist) Vendor— Affected 5.0.0 to before 5.0.13 Fixed in 5.0.13 Patch available GHSA-8559-gwj3-q37r

Remediation

Fix · CNA EasyAdminBundle (EasyCorp) Fixed in 5.0.13
Fix · GHSA-8559-gwj3-q37r easycorp/easyadmin-bundle (Packagist) Fixed in 5.0.13 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-54087
2026-10-03 Alias added: GHSA-8559-gwj3-q37r

References

Other 4

TI-2024-16042 Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE)… CVSS 3.1CRITICAL 9.8
TI-2024-16039 An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community… CVSS 3.1CRITICAL 9.8
TI-2023-24012 An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before… CVSS 3.1HIGH 8.8
TI-2022-23694 ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. CVSS 3.1HIGH 8.8
TI-2023-26980 Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly. CVSS 3.1MEDIUM 6.1
TI-2020-14347 Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute… CVSS 3.1MEDIUM 6.1

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences