CVE-2026-54087: EasyAdmin Symfony XSS Vulnerability

CVE-2026-54087 Overview

CVE-2026-54087 is a stored cross-site scripting (XSS) vulnerability in EasyAdmin, an admin generator for Symfony applications. Versions from 5.0.0 through 5.0.12 allow attackers to upload browser-executable content through FileField and ImageField components. The template templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition: attachment header. When these uploads reside under the public web root, an authenticated administrator opening the file triggers JavaScript execution in the backend origin. The issue is tracked as [CWE-79] and fixed in version 5.0.13.

Critical Impact
Attackers with upload access can steal session and CSRF tokens from administrators and escalate privileges by uploading HTML or SVG files that execute JavaScript in the admin origin.

Affected Products

EasyAdminBundle versions 5.0.0 through 5.0.12
Symfony applications using EasyAdmin FileField for uploads
Symfony applications using EasyAdmin ImageField for uploads

Discovery Timeline

2026-09-14 - CVE CVE-2026-54087 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-54087

Vulnerability Analysis

The vulnerability stems from how EasyAdmin serves uploaded files back to users. FileField accepts arbitrary file uploads, and ImageField accepts SVG images by default. Both file types can contain embedded JavaScript that browsers execute when the content renders inline as a top-level document.

The backend template links to stored files directly. It omits the HTML download attribute and the server does not send a Content-Disposition: attachment response header. When an administrator clicks a view link for an uploaded .html, .svg, .xhtml, or .xml file, the browser renders the content in the admin origin and executes any embedded scripts.

Exploitation requires a privilege gap between the uploader and viewer. A lower-privileged user uploads the malicious file; a higher-privileged administrator triggers execution by opening it. The attacker can then exfiltrate session cookies, CSRF tokens, or issue authenticated requests on behalf of the administrator. The advisory notes the flaw does not permit PHP or PHTML execution because Symfony guessExtension does not produce those stored extensions.

Root Cause

The root cause is missing output-side hardening on file delivery. Uploaded content is stored under the public web root and served with a Content-Type derived from its extension. The template does not force download for dangerous content types, allowing same-origin script execution.

Attack Vector

Exploitation is network-based and requires low privileges plus user interaction from a higher-privileged victim. The attacker uploads a crafted HTML or SVG payload through an affected form, then waits for an administrator to open the file from the backend interface.

text

// Patch excerpt from doc/fields/FileField.rst
// Source: https://github.com/EasyCorp/EasyAdminBundle/commit/8132b2b0ca3876c9261264fa267106a1b2c10a68

Serving Uploaded Files Safely
-----------------------------

Uploaded files are typically stored under the public web root, so they are
served by the web server with the ``Content-Type`` that matches their
extension. Some file types (e.g. ``.html`` and ``.svg``) are rendered *inline*
by browsers and can run embedded JavaScript. If such a file is opened from the
same origin as the backend, that script executes in the session of the user who
opens it (a stored `XSS`_ attack).

To prevent this, EasyAdmin **forces a download** (instead of opening the file
inline) for uploaded files whose type the browser would render and could
execute scripts from, such as ``.html``, ``.svg``, ``.xhtml`` and ``.xml``.
Safe types (images, PDFs, office documents, etc.) keep opening inline as usual.

allowRiskyInlineRender
~~~~~~~~~~~~~~~~~~~~~~

    yield FileField::new('...')->allowRiskyInlineRender();

The patch introduces forced downloads for risky content types and adds an opt-in allowRiskyInlineRender() method for trusted contexts. See the EasyAdmin security advisory GHSA-8559-gwj3-q37r for full details.

Detection Methods for CVE-2026-54087

Indicators of Compromise

Uploaded files stored under the public web root with extensions .html, .htm, .svg, .xhtml, or .xml submitted through EasyAdmin forms.
SVG or HTML files containing <script> tags, onload handlers, or javascript: URIs in EasyAdmin upload directories.
HTTP responses serving uploaded content without a Content-Disposition: attachment header from the admin backend origin.

Detection Strategies

Scan EasyAdmin upload directories for files whose MIME type or content includes executable script markers.
Review web server access logs for administrator sessions accessing uploaded files with risky extensions from backend routes.
Inspect application audit logs for accounts with upload permissions that recently created HTML, XML, or SVG assets.

Monitoring Recommendations

Alert on outbound requests from administrator browser sessions to unexpected destinations shortly after opening uploaded files.
Monitor for anomalous privilege changes or new administrator accounts following upload activity by lower-privileged users.
Track EasyAdminBundle version deployed across Symfony applications and flag installations below 5.0.13.

How to Mitigate CVE-2026-54087

Immediate Actions Required

Upgrade EasyAdminBundle to version 5.0.13 or later across all Symfony applications.
Audit existing upload directories for HTML, SVG, XHTML, and XML files and remove untrusted content.
Rotate administrator session cookies and CSRF tokens if suspicious uploads are found.

Patch Information

The fix is available in EasyAdmin release v5.0.13. The patch forces downloads for browser-executable file types and introduces an opt-in allowRiskyInlineRender() method for cases where administrators fully trust uploaded content. See the patch commit 8132b2b for implementation details.

Workarounds

Restrict upload permissions to fully trusted users until the upgrade is applied.
Configure the web server to send Content-Disposition: attachment for files served from EasyAdmin upload paths.
Serve uploaded content from a separate, sandboxed origin so scripts cannot access administrator session cookies.
Deny direct browser access to .html, .svg, .xhtml, and .xml files stored in upload directories via web server rules.

bash

# Example nginx configuration to force download for risky uploads
location ^~ /uploads/ {
    location ~* \.(html?|svg|xhtml|xml)$ {
        add_header Content-Disposition "attachment";
        add_header X-Content-Type-Options "nosniff";
        default_type application/octet-stream;
    }
}