CVE-2026-54087

EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker with access to an affected form can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin when the file is opened from the backend. Exploitation requires a privilege gap between the uploader and viewer. The issue can expose session or CSRF tokens and enable privilege escalation, but does not permit PHP or PHTML code execution because Symfony guessExtension does not produce those stored extensions. This issue is fixed in version 5.0.13.

• CWE-79
• CWE-434

• https://github.com/EasyCorp/EasyAdminBundle/commit/8132b2b0ca3876c9261264fa267106a1b2c10a68
• https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.0.13
• https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-8559-gwj3-q37r

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54080veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.3…6.9
• CVE-2026-54081veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.3…6.9
• CVE-2026-54082veraPDF validation model is an implementation of the veraPDF…6.5
• CVE-2026-54083Wazuh is an open-source security platform providing unified …8.1
• CVE-2026-54084Wazuh is an open-source security platform providing unified …5.3
• CVE-2026-54085Wazuh is an open-source security platform providing unified …7.1
• CVE-2026-54088File Browser is a file managing interface for uploading, del…9.3
• CVE-2026-54089File Browser is a file managing interface for uploading, del…9.1
• CVE-2026-5409Monero protocol dissector crash in Wireshark 4.6.0 to 4.6.4 …5.5
• CVE-2026-54090File Browser is a file managing interface for uploading, del…8.7
• CVE-2026-54091File Browser is a file managing interface for uploading, del…7.5
• CVE-2026-54092File Browser is a file managing interface for uploading, del…6.5