Read the docs
TI-2026-35602 Aliases CVE-2026-48167GHSA-3fc8-8hp6-6jr4

Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the ImageColumn and ImageEntry components render raw database values without escaping HTML. Where the data passed to these components isn't validated, an attacker could plant malicious HTML or JavaScript and achieve stored XSS that executes for users who view the table or schema. This vulnerability is fixed in 4.11.5 and 5.6.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix Fixed filament (filamentphp): 4.11.5, 5.6.5filament/infolists (Packagist): 4.11.5, 5.6.5+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
filamentphpfilament4.0.0 to before 4.11.5; 5.0.0 to before 5.6.54.11.5, 5.6.5Patch availableCNA
—filament/infolists (Packagist)4.0.0 to before 4.11.54.11.5Patch availableGHSA-3fc8-8hp6-6jr4
—filament/tables (Packagist)4.0.0 to before 4.11.54.11.5Patch availableGHSA-3fc8-8hp6-6jr4
—filament/infolists (Packagist)5.0.0 to before 5.6.55.6.5Patch availableGHSA-3fc8-8hp6-6jr4
—filament/tables (Packagist)5.0.0 to before 5.6.55.6.5Patch availableGHSA-3fc8-8hp6-6jr4
  • filament Vendorfilamentphp Affected 4.0.0 to before 4.11.5; 5.0.0 to before 5.6.5 Fixed in 4.11.5, 5.6.5 Patch available CNA
  • filament/infolists (Packagist) Vendor— Affected 4.0.0 to before 4.11.5 Fixed in 4.11.5 Patch available GHSA-3fc8-8hp6-6jr4
  • filament/tables (Packagist) Vendor— Affected 4.0.0 to before 4.11.5 Fixed in 4.11.5 Patch available GHSA-3fc8-8hp6-6jr4
  • filament/infolists (Packagist) Vendor— Affected 5.0.0 to before 5.6.5 Fixed in 5.6.5 Patch available GHSA-3fc8-8hp6-6jr4
  • filament/tables (Packagist) Vendor— Affected 5.0.0 to before 5.6.5 Fixed in 5.6.5 Patch available GHSA-3fc8-8hp6-6jr4

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*——filamentphp
  • cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:* Versions — — ·filamentphp

Remediation

  • Fix · CNA filament (filamentphp) Fixed in 4.11.5, 5.6.5
  • Fix · GHSA-3fc8-8hp6-6jr4 filament/infolists (Packagist) Fixed in 4.11.5 Advisory →
  • Fix · GHSA-3fc8-8hp6-6jr4 filament/tables (Packagist) Fixed in 4.11.5 Advisory →
  • Fix · GHSA-3fc8-8hp6-6jr4 filament/infolists (Packagist) Fixed in 5.6.5 Advisory →
  • Fix · GHSA-3fc8-8hp6-6jr4 filament/tables (Packagist) Fixed in 5.6.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48167
  2. 2026-10-03 Alias added: GHSA-3fc8-8hp6-6jr4

References

Advisory 1

Other 2

  • TI-2024-34663 Exported files stored in default (`public`) filesystem if not reconfigured in filament CVSS 4.0LOW 2.3
  • TI-2026-54081 Filament: App-based MFA can be bypassed when recovery codes are enabled CVSS 3.1HIGH 8.1
  • TI-2025-41263 Filament's multi-factor authentication (app) recovery codes can be used multiple times CVSS 3.1HIGH 8.1
  • TI-2026-35861 Filament: Unauthenticated temporary file upload on auth pages CVSS 3.1MEDIUM 6.5
  • TI-2026-35865 Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission CVSS 3.1HIGH 7.4
  • TI-2026-39979 Filament: Disabled RichEditor field state can be used for XSS CVSS 3.1HIGH 7.6
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences