EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
Summary
The imported advisory is rated high severity. It identifies 1 affected package; whether you are affected depends on your installed version. It is not listed in the imported CISA KEV data; that does not establish that exploitation has not occurred.
Summary by cve.new · CC BY 4.0Original source description
EasyAdmin's FileField and ImageField accept browser-executable file types by default (FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG). When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin links to the stored file inline (no download attribute or Content-Disposition: attachment).
An attacker with access to a form using these fields can upload an .html (FileField) or .svg (ImageField) file containing JavaScript. When another user opens it from the backend, it is served from the same origin and the script executes in the context of their authenticated admin session, enabling session/CSRF-token theft or privilege escalation.
Exploitation requires the developer to store uploads in the public directory and a privilege gap between the uploading user and the viewing administrator. This is stored XSS only — it does not allow remote code execution, because uploaded filenames are derived from Symfony's guessExtension(), which never produces .php/.phtml.
Credit
We would like to thank Emre Dogan for reporting the issue.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 5.0.0 before 5.0.13
Fixed in 5.0.13
13 explicitly affected versions
v5.0.0, v5.0.1, v5.0.10, v5.0.11, v5.0.12, v5.0.2, v5.0.3, v5.0.4, v5.0.5, v5.0.6, v5.0.7, v5.0.8, v5.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.13"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v5.0.0",
"v5.0.1",
"v5.0.10",
"v5.0.11",
"v5.0.12",
"v5.0.2",
"v5.0.3",
"v5.0.4",
"v5.0.5",
"v5.0.6",
"v5.0.7",
"v5.0.8",
"v5.0.9"
]
}