CVE-2026-54087
EasyAdmin's FileField and ImageField accept browser-executable file types by default (FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG). When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin links to the stored file inline (no download attribute or Content-Disposition: attachment).
An attacker with access to a form using these fields can upload an .html (FileField) or .svg (ImageField) file containing JavaScript. When another user opens it from the backend, it is served from the same origin and the script executes in the context of their authenticated admin session, enabling session/CSRF-token theft or privilege escalation.
Exploitation requires the developer to store uploads in the public directory and a privilege gap between the uploading user and the viewing administrator. This is stored XSS only — it does not allow remote code execution, because uploaded filenames are derived from Symfony's guessExtension(), which never produces .php/.phtml.
Credit
We would like to thank Emre Dogan for reporting the issue.
⚡ Watch CVE-2026-54087
Get an email if CVE-2026-54087 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-54087)