p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in easycorp/easyadmin-bundle

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für easycorp/easyadmin-bundle: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 3

  1. CVE-2026-54087

    Hoch · CVSS 7.6EPSS 0,4%Korrektur verfügbar

    EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

    EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker with access to an affected form can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin when the file is opened from the backend. Exploitation requires a privilege gap between the upload

    easycorp/easyadmin-bundlePHP
    • Auf 5.0.13 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-81892

    Hoch · CVSS 8.1EPSS 0,45%Korrektur verfügbar

    EasyAdmin custom-action dispatcher bypasses access_control on other routes

    EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend use

    easycorp/easyadmin-bundle easycorp/easyadmin-bundlePHP
    • Auf 4.29.16 aktualisieren
    • Auf 5.5.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. GHSA-2wwr-9x6f-88gp

    Mittel · CVSS 5.3Korrektur verfügbar

    EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components

    EasyAdminBundle ships two public Twig components — `<twig:ea:Flag countryCode="...">` and `<twig:ea:Icon name="...">` — that load SVG files from disk using a path built directly from a public component property, and then render the resulting markup with the Twig `|raw` filter. When an application binds either of those properties to data that is influenced by an end user, the lack of validation on the property value leads to two distinct issues: - Arbitrary `.svg` file disclosure (both components) — the property value is concatenated into a filesystem path without normalizing or constraining it, so `..` segments are preserved and resolved by

    easycorp/easyadmin-bundle easycorp/easyadmin-bundlePHP
    • Auf 4.29.10 aktualisieren
    • Auf 5.0.10 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →