GHSA-2wwr-9x6f-88gp
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2wwr-9x6f-88gp
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2wwr-9x6f-88gp/GHSA-2wwr-9x6f-88gp.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-2wwr-9x6f-88gp
- Published
- 2026-07-01T18:18:46Z
- Modified
- 2026-09-10T03:51:09Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components
- Details
-
EasyAdminBundle ships two public Twig components —
<twig:ea:Flag countryCode="...">and<twig:ea:Icon name="...">— that load SVG files from disk using a path built directly from a public component property, and then render the resulting markup with the Twig|rawfilter.When an application binds either of those properties to data that is influenced by an end user, the lack of validation on the property value leads to two distinct issues:
- Arbitrary
.svgfile disclosure (both components) — the property value is concatenated into a filesystem path without normalizing or constraining it, so..segments are preserved and resolved by PHP. Any file on the server whose absolute path ends in.svg(for example, user-uploaded SVG icons stored elsewhere on the host) can be read and embedded into the rendered page. - Reflected XSS in the admin UI (Flag component only) — when the requested flag file does not exist, the Flag component falls back to a hard-coded SVG string that interpolates the raw
countryCodevalue twice, and the parent template renders that string with|raw. An attacker who controlscountryCodecan therefore inject arbitrary HTML/JavaScript that will execute inside the authenticated admin context that rendered the component.
The first-party usage shipped by EasyAdminBundle itself is not affected: the bundle only passes ISO 3166 alpha-2 codes validated through
Symfony\Component\Intl\Countriesto theFlagcomponent, and only hard-codedinternal:..names or values previously set in PHP viaMenuItem::setIcon()to theIconcomponent. The vulnerability is reachable only in third-party templates that pass attacker-controlled data into these properties.Impact
Path traversal is information disclosure bounded by the
.svgextension; reflected XSS in Flag runs in the admin context and is therefore more sensitive but requires a vulnerable template wiring and user interaction.Affected components
EasyCorp\Bundle\EasyAdminBundle\Twig\Component\Flag— public Twig tag<twig:ea:Flag>, propertycountryCode.EasyCorp\Bundle\EasyAdminBundle\Twig\Component\Icon— public Twig tag<twig:ea:Icon>, propertynamewhen the value starts with theinternal:prefix.
Credit
EasyAdmin would like to thank Claude Mythos Preview (via Project Glasswing and The PHP Foundation) for reporting the issue and providing the fix.
- Arbitrary
- Database specific
{ "cwe_ids": [ "CWE-22", "CWE-73", "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2026-07-01T18:18:46Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
Packagist / easycorp/easyadmin-bundle
Package
- Name
- easycorp/easyadmin-bundle
- Purl
- pkg:composer/easycorp/easyadmin-bundle
Affected versions
v4.*
Packagist / easycorp/easyadmin-bundle
Package
- Name
- easycorp/easyadmin-bundle
- Purl
- pkg:composer/easycorp/easyadmin-bundle