Advisories for Composer/Easycorp/Easyadmin-Bundle package

EasyAdmin's FileField and ImageField accept browser-executable file types by default (FileField applies no MIME/extension restrictions; ImageField's default Image constraint accepts SVG). When the upload directory is configured inside the public web root — as shown in the documentation — EasyAdmin links to the stored file inline (no download attribute or Content-Disposition: attachment). An attacker with access to a form using these fields can upload an .html (FileField) or .svg (ImageField) …

EasyAdminBundle ships two public Twig components — <twig:ea:Flag countryCode="…"> and <twig:ea:Icon name="…"> — that load SVG files from disk using a path built directly from a public component property, and then render the resulting markup with the Twig |raw filter. When an application binds either of those properties to data that is influenced by an end user, the lack of validation on the property value leads to two distinct issues: …