EUVD-2026-38394
GHSA-44wp-g8f4-f4v5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Network-reachable login endpoint, no auth or interaction needed; impact limited to low integrity (temp file writes) and low availability (disk exhaustion); no confidentiality loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component the schema is embedded in. However, some schemas, such as the panel login form, do not require file uploads, and exposing unauthenticated temporary file uploads on these components is not an acceptable risk. On these components, an unauthenticated attacker could upload arbitrary files to the application's temporary storage, which could be abused to exhaust disk space or inflate storage costs. This vulnerability is fixed in 3.3.52, 4.11.5, and 5.6.5.
AnalysisAI
Unauthenticated arbitrary file upload in Filament (Laravel component framework) versions 3.0.0 through 3.3.51, 4.x through 4.11.4, and 5.x through 5.6.4 allows remote attackers without any credentials to write files to the application's temporary storage. Filament indiscriminately applies Livewire's WithFileUploads trait to every Livewire component embedding a schema - including the panel login form, which has no legitimate file upload need - exposing the upload endpoint publicly. The practical impact is storage exhaustion or inflated cloud storage costs; no public exploit has been identified at time of analysis.
Technical ContextAI
Filament is a full-stack component suite for Laravel applications built on top of Livewire, a PHP framework for reactive UI components. The root cause is CWE-862 (Missing Authorization): Filament's schema system automatically mixes Livewire's WithFileUploads trait into any Livewire component hosting a schema, regardless of whether that component actually uses a file upload field. This trait registers Livewire's temporary file upload route, which is then reachable without authentication when the hosting component is itself unauthenticated - as is typically the case with the panel login form. The affected CPE is cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*, covering the entire 3.x, 4.x, and 5.x release lines prior to the fixed versions.
RemediationAI
Upgrade to Filament 3.3.52, 4.11.5, or 5.6.5 immediately, as all three release lines have vendor-released patches available. The fix restricts the application of Livewire's WithFileUploads trait to only those schema components that actually contain a file upload field, eliminating the unauthenticated temporary upload endpoint on components like the login form. Full details are in the vendor advisory at https://github.com/filamentphp/filament/security/advisories/GHSA-44wp-g8f4-f4v5. If immediate patching is not feasible, a compensating control is to configure the reverse proxy or WAF to block or rate-limit multipart/form-data POST requests to the Livewire temporary upload route (typically /livewire/upload-file) for unauthenticated sessions; note this may break legitimate file upload functionality on any public-facing Filament forms. Enforcing maximum request body size limits at the reverse proxy (e.g., client_max_body_size in nginx) can cap the storage exhaustion blast radius without functional disruption.
App-based multi-factor authentication in Filament (the Laravel admin panel framework) can be fully bypassed by an attack
Recovery code reuse in Filament (Laravel admin panel framework) versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4 al
TOTP app-based MFA in Filament 4.0.0-4.12.5 and 5.0.0-5.7.5 can be bypassed by replaying any previously-issued authentic
Stored cross-site scripting in Filament's ImageColumn and ImageEntry components allows low-privileged authenticated atta
Filament is a collection of full-stack components for Laravel development. Rated medium severity (CVSS 6.1), this vulner
Filament's login page leaks account existence through a measurable timing side-channel, allowing unauthenticated remote
Password oracle in Filament's login flow (packages/panels/src/Auth/Pages/Login.php) allows unauthenticated remote attack
Same weakness CWE-862 – Missing Authorization
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today