Read the docs
TI-2026-35861 Aliases CVE-2026-48500GHSA-44wp-g8f4-f4v5

Filament: Unauthenticated temporary file upload on auth pages

Priority LOW 35CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component the schema is embedded in. However, some schemas, such as the panel login form, do not require file uploads, and exposing unauthenticated temporary file uploads on these components is not an acceptable risk. On these components, an unauthenticated attacker could upload arbitrary files to the application's temporary storage, which could be abused to exhaust disk space or inflate storage costs. This vulnerability is fixed in 3.3.52, 4.11.5, and 5.6.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00343 28th percentileScored 2026-11-07
Fix Fixed filament (filamentphp): 3.3.52, 5.6.5, 4.11.5filament/filament (Packagist): 4.11.5, 5.6.5, 3.3.52

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
filamentphpfilament3.0.0 to before 3.3.52; 5.0.0 to before 5.6.5; 4.0.0 to before 4.11.53.3.52, 5.6.5, 4.11.5Patch availableCNA
—filament/filament (Packagist)4.0.0 to before 4.11.54.11.5Patch availableGHSA-44wp-g8f4-f4v5
—filament/filament (Packagist)5.0.0 to before 5.6.55.6.5Patch availableGHSA-44wp-g8f4-f4v5
—filament/filament (Packagist)3.0.0 to before 3.3.523.3.52Patch availableGHSA-44wp-g8f4-f4v5
  • filament Vendorfilamentphp Affected 3.0.0 to before 3.3.52; 5.0.0 to before 5.6.5; 4.0.0 to before 4.11.5 Fixed in 3.3.52, 5.6.5, 4.11.5 Patch available CNA
  • filament/filament (Packagist) Vendor— Affected 4.0.0 to before 4.11.5 Fixed in 4.11.5 Patch available GHSA-44wp-g8f4-f4v5
  • filament/filament (Packagist) Vendor— Affected 5.0.0 to before 5.6.5 Fixed in 5.6.5 Patch available GHSA-44wp-g8f4-f4v5
  • filament/filament (Packagist) Vendor— Affected 3.0.0 to before 3.3.52 Fixed in 3.3.52 Patch available GHSA-44wp-g8f4-f4v5

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*——filamentphp
  • cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:* Versions — — ·filamentphp

Remediation

  • Fix · CNA filament (filamentphp) Fixed in 3.3.52, 5.6.5, 4.11.5
  • Fix · GHSA-44wp-g8f4-f4v5 filament/filament (Packagist) Fixed in 4.11.5 Advisory →
  • Fix · GHSA-44wp-g8f4-f4v5 filament/filament (Packagist) Fixed in 5.6.5 Advisory →
  • Fix · GHSA-44wp-g8f4-f4v5 filament/filament (Packagist) Fixed in 3.3.52 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48500
  2. 2026-10-03 Alias added: GHSA-44wp-g8f4-f4v5

References

Advisory 1

Other 2

  • TI-2024-34663 Exported files stored in default (`public`) filesystem if not reconfigured in filament CVSS 4.0LOW 2.3
  • TI-2026-54081 Filament: App-based MFA can be bypassed when recovery codes are enabled CVSS 3.1HIGH 8.1
  • TI-2025-41263 Filament's multi-factor authentication (app) recovery codes can be used multiple times CVSS 3.1HIGH 8.1
  • TI-2026-35865 Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission CVSS 3.1HIGH 7.4
  • TI-2026-39979 Filament: Disabled RichEditor field state can be used for XSS CVSS 3.1HIGH 7.6
  • TI-2026-25522 Filament: Unvalidated Range and Values summarizer values can be used for XSS CVSS 3.1HIGH 7.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences