Skip to content
Threat Feed
Subscribe

Product

EasyAdmin Bundle (Versions >= 5.0.0, < 5.0.13)

1 brief RSS
high advisory

EasyAdmin Bundle Stored Cross-Site Scripting via File Uploads (CVE-2026-54087)

A high-severity stored cross-site scripting (XSS) vulnerability, tracked as CVE-2026-54087, exists in EasyAdmin Bundle versions >= 5.0.0 and < 5.0.13, allowing attackers to upload malicious HTML or SVG files containing JavaScript which executes in an administrator's session when viewed in the backend, leading to session/CSRF token theft and privilege escalation.

EasyAdmin Bundle xss web-application vulnerability easyadmin
1t