EUVD-2026-38395
GHSA-3fc8-8hp6-6jr4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects required write access to the affected column; S:C captures cross-user browser execution; UI:N applies because stored payload fires automatically on page load.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the ImageColumn and ImageEntry components render raw database values without escaping HTML. Where the data passed to these components isn't validated, an attacker could plant malicious HTML or JavaScript and achieve stored XSS that executes for users who view the table or schema. This vulnerability is fixed in 4.11.5 and 5.6.5.
AnalysisAI
Stored cross-site scripting in Filament's ImageColumn and ImageEntry components allows low-privileged authenticated attackers to plant malicious HTML or JavaScript into database-backed image fields, which then executes in the browsers of any user who views the affected table or schema. Affected versions span 4.0.0 through the pre-fix releases across both the v4 and v5 branches of this widely-used Laravel admin panel framework. Vendor-released patches exist at versions 4.11.5 and 5.6.5; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Filament (cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*) is a full-stack Laravel UI component library providing table, form, and schema components for building admin panels. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in two rendering components - ImageColumn (used in tables) and ImageEntry (used in infolist/detail schemas) - which pass raw database column values into the HTML output without applying PHP's htmlspecialchars or Blade's double-curly escaping. Because Laravel Blade's {!! !!} unescaped syntax or equivalent raw rendering is used internally, any attacker-controlled string stored in the underlying database column is reflected verbatim into page markup, making this a stored (persistent) XSS vector. The CVSS Scope:Changed metric correctly captures that the impact escapes the application's own security boundary and executes in the victim user's browser context.
RemediationAI
Upgrade to Filament 4.11.5 (for v4 branch users) or 5.6.5 (for v5 branch users) - these are the vendor-confirmed fixed releases per the GitHub Security Advisory GHSA-3fc8-8hp6-6jr4 at https://github.com/filamentphp/filament/security/advisories/GHSA-3fc8-8hp6-6jr4. Run composer update filament/filament within the appropriate version constraint to pull the fix. If immediate upgrade is not possible, the primary compensating control is to enforce strict server-side input validation on any field that populates ImageColumn or ImageEntry columns - reject values containing HTML tags or JavaScript URI schemes (e.g., javascript:) before persistence. Restricting write access to the affected database columns to trusted roles only reduces the attacker pool. Note that client-side or WAF-based XSS filtering is not a reliable substitute for output escaping and should not be treated as a permanent mitigation.
TOTP app-based MFA in Filament 4.0.0-4.12.5 and 5.0.0-5.7.5 can be bypassed by replaying any previously-issued authentic
App-based multi-factor authentication in Filament (the Laravel admin panel framework) can be fully bypassed by an attack
Password oracle in Filament's login flow (packages/panels/src/Auth/Pages/Login.php) allows unauthenticated remote attack
Recovery code reuse in Filament (Laravel admin panel framework) versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4 al
Unauthenticated arbitrary file upload in Filament (Laravel component framework) versions 3.0.0 through 3.3.51, 4.x throu
Filament is a collection of full-stack components for Laravel development. Rated medium severity (CVSS 6.1), this vulner
Filament's login page leaks account existence through a measurable timing side-channel, allowing unauthenticated remote
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today