AIKIDO-2026-10519

TL;DR

Multiple vulnerabilities in EasyAdminBundle allowed authorization bypass in batch delete actions through attacker-controlled entity class parameters, stored XSS through dangerous URL schemes rendered as clickable links, CSS injection through unsanitized color values, path traversal through unsafe stored upload filenames, and missing permission checks on internal autocomplete/filter endpoints. Successful exploitation could let authenticated users access unauthorized data, delete unintended entities, execute script in admin sessions, or read local files.