Skip to content
OpenAdvisories

Package · Packagist

easycorp/easyadmin-bundle

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.6
    CVE-2026-54087

    EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

    EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering w…

    EasyCorp EasyAdminBundle easycorp/easyadmin-bundle Packagist
  • High 8.1
    CVE-2026-81892

    EasyAdmin custom-action dispatcher bypasses access_control on other routes

    EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), sw…

    EasyCorp EasyAdminBundle easycorp/easyadmin-bundle Packagist
  • Medium 5.3
    GHSA-2wwr-9x6f-88gp

    EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components

    EasyAdminBundle ships two public Twig components — `<twig:ea:Flag countryCode="...">` and `<twig:ea:Icon name="...">` — that load SVG files from disk using a path built directly from a public component property, and then render the resulting markup with the T…

    easycorp/easyadmin-bundle Packagist