Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() / MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. That swap happens after Symfony's security firewall has already evaluated accesscontrol against the original dashboard URL, and the routeName value was not validated. As a result, a path-based accesscontrol rule protecting the target route was never evaluated, so a low-privilege backend user could reach a more restricted route by name. Impact Any application where accesscontrol (or another path-based Symfony security rule) protects some routes more strictly than the dashboard URL used to reach EasyAdmin. An attacker who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own…
Recommended action: Upgrade to 5.5.1 or 4.29.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
EasyAdmin's FileField and ImageField accept browser-executable file types by default (FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG). When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin links to the stored file inline (no download attribute or Content-Disposition: attachment). An attacker with access to a form using these fields can upload an .html (FileField) or .svg (ImageField) file containing JavaScript. When another user opens it from the backend, it is served from the same origin and the script executes in the context of their authenticated admin session, enabling session/CSRF-token theft or privilege escalation. Exploitation requires the developer to store uploads in the public directory and a privilege gap between the uploading user and the viewing administrator. This is stored XSS only — it does not allow remote code execution, because uploaded filenames are…
Recommended action: Upgrade to 5.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
EasyAdminBundle ships two public Twig components — <twig:ea:Flag countryCode="..." and <twig:ea:Icon name="..." — that load SVG files from disk using a path built directly from a public component property, and then render the resulting markup with the Twig |raw filter. When an application binds either of those properties to data that is influenced by an end user, the lack of validation on the property value leads to two distinct issues: - Arbitrary .svg file disclosure (both components) — the property value is concatenated into a filesystem path without normalizing or constraining it, so .. segments are preserved and resolved by PHP. Any file on the server whose absolute path ends in .svg (for example, user-uploaded SVG icons stored elsewhere on the host) can be read and embedded into the rendered page. - Reflected XSS in the admin UI (Flag component only) — when the requested flag file does not exist, the Flag component falls back to a hard-coded SVG string that interpolates the raw…
Recommended action: Upgrade to 5.0.10 or 4.29.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.