CVE-2026-54087 EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
Attackers can upload malicious files to trigger stored XSS in admin views, potentially stealing session tokens and escalating privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-54087?
CVE-2026-54087 is a high-severity cross-site scripting vulnerability in EasyCorp EasyAdminBundle, published on 14 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker with access to an affected form can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin when the file is opened from the backend. Exploitation requires a privilege gap between the uploader and viewer. The issue can expose session or CSRF tokens and enable privilege escalation, but does not permit PHP or PHTML code execution because Symfony guessExtension does not produce those stored extensions. This issue is fixed in version 5.0.13.
Which versions are affected by CVE-2026-54087?
2 open source packages ship an affected version, including easycorp/easyadmin-bundle.
| Package | Affected | Fixed in |
|---|---|---|
easycorp/easyadmin-bundle Packagist | From 5.0.0 | 5.0.13 |
easycorp/easyadmin-bundle Packagist | From 5.0.0 | 5.0.13 |
How do I fix CVE-2026-54087?
Upgrade easycorp/easyadmin-bundle to 5.0.13 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-54087 being exploited?
There is no known exploitation of CVE-2026-54087 in the wild and no public exploit code.
Sources
Also known as GHSA-8559-gwj3-q37r.