CVE-2026-50894
Last modified
CVE-2026-50894 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload.. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | n/a |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-50894?
How severe is CVE-2026-50894?
How do I fix CVE-2026-50894?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-50888An authenticated Server-Side Request Forgery (SSRF) in the c…8.1
- CVE-2026-50889An input handling flaw in the HTTP refresh token process of …7.5
- CVE-2026-5089YAML::Syck versions before 1.38 for Perl has an out-of-boun…7.3
- CVE-2026-50890Bernd Bestel grocy v4.6.0 was discovered to contain a SQL in…9.8
- CVE-2026-50891Incorrect access control in the /admin/api/config component …8.1
- CVE-2026-50892Incorrect access control in the "Let's Encrypt" certificate …6.5
- CVE-2026-5090Template::Plugin::HTML versions before 3.103 for Perl allows…6.1
- CVE-2026-5091Catalyst::Plugin::Authentication versions through 0.10024 fo…5.1
- CVE-2026-5092The Greenshift – animation and page builder blocks plugin fo…6.4
- CVE-2026-5093The GreenShift – Animation and Page Builder Blocks plugin fo…4.3
- CVE-2026-5096The Everest Forms plugin for WordPress is vulnerable to Serv…5.3
- CVE-2026-5097The wpForo Forum plugin for WordPress is vulnerable to SQL I…7.5
Are you affected by CVE-2026-50894?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST