Advisories for Composer/Easycorp/Easyadmin-Bundle package

EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() / MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. That swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a …

EasyAdmin's FileField and ImageField accept browser-executable file types by default (FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG). When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin links to the stored file inline (no download attribute or Content-Disposition: attachment). An attacker with access to a form using these fields can upload an .html (FileField) or .svg (ImageField) …

EasyAdminBundle ships two public Twig components — <twig:ea:Flag countryCode="…"> and <twig:ea:Icon name="…"> — that load SVG files from disk using a path built directly from a public component property, and then render the resulting markup with the Twig |raw filter. When an application binds either of those properties to data that is influenced by an end user, the lack of validation on the property value leads to two distinct issues: …