CVE-2026-50894

In EasyAdmin from 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin.

In EasyAdmin (an admin generator for Symfony) versions from 4.0.0 to 4.29.16 and 5.5.1, there is a vulnerability where path-based access control can be bypassed. This occurs because the controller swap happens after the firewall check, and the routeName parameter is not validated. A low-privilege user can execute another route's controller if they know its name, bypassing path-based protections. Routes that enforce their own authorization (e.g., via #[IsGranted]) remain protected. The issue is fixed in versions 4.29.16 and 5.5.1.