Description

EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker with access to an affected form can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin when the file is opened from the backend. Exploitation requires a privilege gap between the uploader and viewer. The issue can expose session or CSRF tokens and enable privilege escalation, but does not permit PHP or PHTML code execution because Symfony guessExtension does not produce those stored extensions. This issue is fixed in version 5.0.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-14T18:17:51.930Z",
  "pubdate": "2026-09-14T18:17:51.930Z",
  "executiveSummary": "EasyAdmin versions 5.0.0 through 5.0.12 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability via the FileField and ImageField components.\nThe vulnerability arises due to the application's failure to enforce secure file handling policies, such as the Content-Disposition header, when serving user-uploaded files from the public web root.\nAn authenticated attacker with form access can upload malicious HTML or SVG files containing arbitrary JavaScript. When a higher-privileged administrator views these files within the EasyAdmin backend, the malicious script executes within the application's origin.\nThis vulnerability facilitates session hijacking, theft of CSRF tokens, and potential privilege escalation by leveraging the trust relationship between the administrator's authenticated session and the application.\nThe flaw stems from the application rendering these files inline without proper sanitization or attachment enforcement, allowing browser-executable content to be treated as legitimate resources.\nSuccessful exploitation requires a privilege gap where a low-privileged user can upload files that are subsequently accessed by an administrative user.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of server-side file assets within EasyAdmin’s templates/crud/field/file.html.twig. By design, the administrative interface serves stored files directly from the public web root for inline rendering within the browser.\nIn affected versions (5.0.0 to 5.0.12), the application fails to utilize the 'download' attribute or enforce a 'Content-Disposition: attachment' header. Consequently, browsers interpret content-types such as 'text/html' or 'image/svg+xml' as active web documents rather than static binary blobs.\nAn attacker leverages this by uploading a crafted payload, such as a malicious SVG image containing script tags or an HTML file, through the FileField or ImageField components. While Symfony's guessExtension function prevents the upload of server-side executable extensions (e.g., .php, .phtml), it does not restrict browser-executable content like HTML or SVG.\nThe exploitation flow proceeds as follows: First, the attacker uploads a malicious file to the public directory. Second, the file remains dormant until an authenticated administrator navigates to the EasyAdmin backend to view the file or the list containing the file reference. Third, the administrator’s browser triggers an HTTP request to the file path. Fourth, the server serves the file without protective headers. Finally, the browser parses the file content, executing the embedded JavaScript within the administrative user’s session context.\nThe impact is significant, as the executed script gains access to the Document Object Model (DOM) of the administration panel. This allows the attacker to exfiltrate session cookies, bypass CSRF protections for subsequent administrative actions, or perform unauthorized administrative operations on behalf of the victim.\nBecause the execution occurs within the same-origin policy of the administrative dashboard, the payload inherits the full privileges of the authenticated administrator, effectively bridging the privilege gap between the attacker and the victim."
}