{"id":"GHSA-2wwr-9x6f-88gp","summary":"EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components","details":"EasyAdminBundle ships two public Twig components — `\u003ctwig:ea:Flag countryCode=\"...\"\u003e` and `\u003ctwig:ea:Icon name=\"...\"\u003e` — that load SVG files from disk using a path built directly from a public component property, and then render the resulting markup with the Twig `|raw` filter.\n\nWhen an application binds either of those properties to data that is influenced by an end user, the lack of validation on the property value leads to two distinct issues:\n\n- Arbitrary `.svg` file disclosure (both components) — the property value is concatenated into a filesystem path without normalizing or constraining it, so `..` segments are preserved and resolved by PHP. Any file on the server whose absolute path ends in `.svg` (for example, user-uploaded SVG icons stored elsewhere on the host) can be read and embedded into the rendered page.\n- Reflected XSS in the admin UI (Flag component only) — when the requested flag file does not exist, the Flag component falls back to a hard-coded SVG string that interpolates the raw `countryCode` value twice, and the parent template renders that string with `|raw`. An attacker who controls `countryCode` can therefore inject arbitrary HTML/JavaScript that will execute inside the authenticated admin context that rendered the component.\n\nThe first-party usage shipped by EasyAdminBundle itself is not affected: the bundle only passes ISO 3166 alpha-2 codes validated through `Symfony\\Component\\Intl\\Countries` to the `Flag` component, and only hard-coded `internal:..` names or values previously set in PHP via `MenuItem::setIcon()` to the `Icon` component. The vulnerability is reachable only in third-party templates that pass attacker-controlled data into these properties.\n\n### Impact\n\nPath traversal is information disclosure bounded by the `.svg` extension; reflected XSS in Flag runs in the admin context and is therefore more sensitive but requires a vulnerable template wiring and user interaction.\n\n### Affected components\n\n- `EasyCorp\\Bundle\\EasyAdminBundle\\Twig\\Component\\Flag` — public Twig tag `\u003ctwig:ea:Flag\u003e`, property `countryCode`.\n- `EasyCorp\\Bundle\\EasyAdminBundle\\Twig\\Component\\Icon` — public Twig tag `\u003ctwig:ea:Icon\u003e`, property `name` when the value starts with the `internal:` prefix.\n\n### Credit\n\nEasyAdmin would like to thank Claude Mythos Preview (via Project Glasswing and The PHP Foundation) for reporting the issue and providing the fix.","modified":"2026-09-10T03:51:09.989937624Z","published":"2026-07-01T18:18:46Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-07-01T18:18:46Z","nvd_published_at":null,"cwe_ids":["CWE-22","CWE-73","CWE-79"]},"references":[{"type":"WEB","url":"https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-2wwr-9x6f-88gp"},{"type":"PACKAGE","url":"https://github.com/EasyCorp/EasyAdminBundle"}],"affected":[{"package":{"name":"easycorp/easyadmin-bundle","ecosystem":"Packagist","purl":"pkg:composer/easycorp/easyadmin-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.29.10"}]}],"versions":["v4.0.0","v4.0.1","v4.0.10","v4.0.2","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.2","v4.10.0","v4.10.1","v4.10.2","v4.10.3","v4.10.4","v4.10.5","v4.11.0","v4.11.1","v4.12.0","v4.13.0","v4.13.1","v4.13.2","v4.13.3","v4.13.4","v4.13.5","v4.13.6","v4.14.0","v4.14.1","v4.14.2","v4.14.3","v4.14.4","v4.14.5","v4.15.0","v4.15.1","v4.16.0","v4.16.1","v4.16.2","v4.17.0","v4.18.0","v4.19.0","v4.2.0","v4.2.1","v4.2.2","v4.2.3","v4.2.4","v4.20.0","v4.20.1","v4.20.2","v4.20.3","v4.20.4","v4.20.5","v4.20.6","v4.20.7","v4.20.8","v4.21.0","v4.21.1","v4.22.0","v4.22.1","v4.22.2","v4.23.0","v4.23.1","v4.23.2","v4.23.3","v4.24.0","v4.24.1","v4.24.2","v4.24.3","v4.24.4","v4.24.5","v4.24.6","v4.24.7","v4.24.8","v4.24.9","v4.25.0","v4.25.1","v4.26.0","v4.26.1","v4.26.2","v4.26.3","v4.26.4","v4.26.5","v4.27.0","v4.27.1","v4.27.2","v4.27.3","v4.27.4","v4.27.5","v4.27.6","v4.27.7","v4.27.8","v4.28.0","v4.28.1","v4.29.0","v4.29.1","v4.29.2","v4.29.3","v4.29.4","v4.29.5","v4.29.6","v4.29.7","v4.29.8","v4.29.9","v4.3.0","v4.3.1","v4.3.2","v4.3.3","v4.3.4","v4.3.5","v4.4.0","v4.4.1","v4.4.2","v4.4.3","v4.4.4","v4.4.5","v4.5.0","v4.5.1","v4.5.2","v4.6.0","v4.6.1","v4.6.2","v4.6.3","v4.6.4","v4.6.5","v4.6.6","v4.7.0","v4.7.1","v4.7.2","v4.7.3","v4.7.4","v4.7.5","v4.7.6","v4.7.7","v4.8.0","v4.8.1","v4.8.10","v4.8.11","v4.8.12","v4.8.13","v4.8.2","v4.8.3","v4.8.4","v4.8.5","v4.8.6","v4.8.7","v4.8.8","v4.8.9","v4.9.0","v4.9.1","v4.9.2","v4.9.3","v4.9.4","v4.9.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2wwr-9x6f-88gp/GHSA-2wwr-9x6f-88gp.json"}},{"package":{"name":"easycorp/easyadmin-bundle","ecosystem":"Packagist","purl":"pkg:composer/easycorp/easyadmin-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.10"}]}],"versions":["v5.0.0","v5.0.1","v5.0.2","v5.0.3","v5.0.4","v5.0.5","v5.0.6","v5.0.7","v5.0.8","v5.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2wwr-9x6f-88gp/GHSA-2wwr-9x6f-88gp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}