{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "easycorp/easyadmin-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.29.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "easycorp/easyadmin-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-73",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-01T18:18:46Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "EasyAdminBundle ships two public Twig components \u2014 `\u003ctwig:ea:Flag countryCode=\"...\"\u003e` and `\u003ctwig:ea:Icon name=\"...\"\u003e` \u2014 that load SVG files from disk using a path built directly from a public component property, and then render the resulting markup with the Twig `|raw` filter.\n\nWhen an application binds either of those properties to data that is influenced by an end user, the lack of validation on the property value leads to two distinct issues:\n\n- Arbitrary `.svg` file disclosure (both components) \u2014 the property value is concatenated into a filesystem path without normalizing or constraining it, so `..` segments are preserved and resolved by PHP. Any file on the server whose absolute path ends in `.svg` (for example, user-uploaded SVG icons stored elsewhere on the host) can be read and embedded into the rendered page.\n- Reflected XSS in the admin UI (Flag component only) \u2014 when the requested flag file does not exist, the Flag component falls back to a hard-coded SVG string that interpolates the raw `countryCode` value twice, and the parent template renders that string with `|raw`. An attacker who controls `countryCode` can therefore inject arbitrary HTML/JavaScript that will execute inside the authenticated admin context that rendered the component.\n\nThe first-party usage shipped by EasyAdminBundle itself is not affected: the bundle only passes ISO 3166 alpha-2 codes validated through `Symfony\\Component\\Intl\\Countries` to the `Flag` component, and only hard-coded `internal:..` names or values previously set in PHP via `MenuItem::setIcon()` to the `Icon` component. The vulnerability is reachable only in third-party templates that pass attacker-controlled data into these properties.\n\n### Impact\n\nPath traversal is information disclosure bounded by the `.svg` extension; reflected XSS in Flag runs in the admin context and is therefore more sensitive but requires a vulnerable template wiring and user interaction.\n\n### Affected components\n\n- `EasyCorp\\Bundle\\EasyAdminBundle\\Twig\\Component\\Flag` \u2014 public Twig tag `\u003ctwig:ea:Flag\u003e`, property `countryCode`.\n- `EasyCorp\\Bundle\\EasyAdminBundle\\Twig\\Component\\Icon` \u2014 public Twig tag `\u003ctwig:ea:Icon\u003e`, property `name` when the value starts with the `internal:` prefix.\n\n### Credit\n\nEasyAdmin would like to thank Claude Mythos Preview (via Project Glasswing and The PHP Foundation) for reporting the issue and providing the fix.",
  "id": "GHSA-2wwr-9x6f-88gp",
  "modified": "2026-07-01T18:18:46Z",
  "published": "2026-07-01T18:18:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-2wwr-9x6f-88gp"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/EasyCorp/EasyAdminBundle"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components"
}