Filamentphp
Monthly
App-based multi-factor authentication in Filament (the Laravel admin panel framework) can be fully bypassed by an attacker who possesses a user's primary credentials when recovery codes are enabled on the targeted account. Exploiting incorrect `required()` field logic in the MFA challenge form, an authenticated-first-factor attacker can toggle the recovery code path and submit the MFA form with both the TOTP code and recovery code fields left blank, passing validation and gaining full account access. Email-based MFA is unaffected; no public exploit or CISA KEV listing exists at time of analysis, though the logic flaw is straightforward and the fix is trivially reversible to derive an exploit.
Recovery code reuse in Filament (Laravel admin panel framework) versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4 allows attackers who already possess a victim's password and recovery codes to obtain multiple authenticated sessions per single recovery code by submitting parallel authentication requests. The flaw stems from a TOCTOU race condition (CWE-362) in app-based MFA recovery code validation, undermining the single-use guarantee. No public exploit identified at time of analysis and the vulnerability is fixed in 4.11.5 and 5.6.5.
Password oracle in Filament's login flow (packages/panels/src/Auth/Pages/Login.php) allows unauthenticated remote attackers to confirm whether a guessed credential is valid for accounts that have MFA enabled but are denied panel access via canAccessPanel(). The observable discrepancy - a MFA challenge on a correct password versus a generic failure on an incorrect one - leaks credential validity without granting any session or panel access. Fixed in v4.12.5 and v5.7.5; no public exploit or KEV listing confirmed at time of analysis.
TOTP app-based MFA in Filament 4.0.0-4.12.5 and 5.0.0-5.7.5 can be bypassed by replaying any previously-issued authenticator app code still within the configured clock-skew window, even after the legitimate account holder has authenticated with a newer code from the same window. The flaw is a cache-key design error: used-code state was keyed on md5(secret + code) rather than md5(secret) alone, making each distinct valid code within the window independently reusable once rather than collectively consuming the accepted timestep as RFC 6238 requires. An attacker holding the target's password and one intercepted TOTP code has approximately four minutes to authenticate and fully bypass MFA. No public exploit has been identified at time of analysis; email-based MFA is explicitly unaffected.
Stored cross-site scripting in Filament's ImageColumn and ImageEntry components allows low-privileged authenticated attackers to plant malicious HTML or JavaScript into database-backed image fields, which then executes in the browsers of any user who views the affected table or schema. Affected versions span 4.0.0 through the pre-fix releases across both the v4 and v5 branches of this widely-used Laravel admin panel framework. Vendor-released patches exist at versions 4.11.5 and 5.6.5; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file upload in Filament (Laravel component framework) versions 3.0.0 through 3.3.51, 4.x through 4.11.4, and 5.x through 5.6.4 allows remote attackers without any credentials to write files to the application's temporary storage. Filament indiscriminately applies Livewire's WithFileUploads trait to every Livewire component embedding a schema - including the panel login form, which has no legitimate file upload need - exposing the upload endpoint publicly. The practical impact is storage exhaustion or inflated cloud storage costs; no public exploit has been identified at time of analysis.
Filament's login page leaks account existence through a measurable timing side-channel, allowing unauthenticated remote attackers to enumerate registered email addresses. Versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4 of this widely-used Laravel full-stack component library are affected. The impact is confined to account enumeration - no credentials, session tokens, or other data are exposed - but the disclosed information can seed targeted phishing or credential-stuffing campaigns. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Filament is a collection of full-stack components for Laravel development. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
App-based multi-factor authentication in Filament (the Laravel admin panel framework) can be fully bypassed by an attacker who possesses a user's primary credentials when recovery codes are enabled on the targeted account. Exploiting incorrect `required()` field logic in the MFA challenge form, an authenticated-first-factor attacker can toggle the recovery code path and submit the MFA form with both the TOTP code and recovery code fields left blank, passing validation and gaining full account access. Email-based MFA is unaffected; no public exploit or CISA KEV listing exists at time of analysis, though the logic flaw is straightforward and the fix is trivially reversible to derive an exploit.
Recovery code reuse in Filament (Laravel admin panel framework) versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4 allows attackers who already possess a victim's password and recovery codes to obtain multiple authenticated sessions per single recovery code by submitting parallel authentication requests. The flaw stems from a TOCTOU race condition (CWE-362) in app-based MFA recovery code validation, undermining the single-use guarantee. No public exploit identified at time of analysis and the vulnerability is fixed in 4.11.5 and 5.6.5.
Password oracle in Filament's login flow (packages/panels/src/Auth/Pages/Login.php) allows unauthenticated remote attackers to confirm whether a guessed credential is valid for accounts that have MFA enabled but are denied panel access via canAccessPanel(). The observable discrepancy - a MFA challenge on a correct password versus a generic failure on an incorrect one - leaks credential validity without granting any session or panel access. Fixed in v4.12.5 and v5.7.5; no public exploit or KEV listing confirmed at time of analysis.
TOTP app-based MFA in Filament 4.0.0-4.12.5 and 5.0.0-5.7.5 can be bypassed by replaying any previously-issued authenticator app code still within the configured clock-skew window, even after the legitimate account holder has authenticated with a newer code from the same window. The flaw is a cache-key design error: used-code state was keyed on md5(secret + code) rather than md5(secret) alone, making each distinct valid code within the window independently reusable once rather than collectively consuming the accepted timestep as RFC 6238 requires. An attacker holding the target's password and one intercepted TOTP code has approximately four minutes to authenticate and fully bypass MFA. No public exploit has been identified at time of analysis; email-based MFA is explicitly unaffected.
Stored cross-site scripting in Filament's ImageColumn and ImageEntry components allows low-privileged authenticated attackers to plant malicious HTML or JavaScript into database-backed image fields, which then executes in the browsers of any user who views the affected table or schema. Affected versions span 4.0.0 through the pre-fix releases across both the v4 and v5 branches of this widely-used Laravel admin panel framework. Vendor-released patches exist at versions 4.11.5 and 5.6.5; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file upload in Filament (Laravel component framework) versions 3.0.0 through 3.3.51, 4.x through 4.11.4, and 5.x through 5.6.4 allows remote attackers without any credentials to write files to the application's temporary storage. Filament indiscriminately applies Livewire's WithFileUploads trait to every Livewire component embedding a schema - including the panel login form, which has no legitimate file upload need - exposing the upload endpoint publicly. The practical impact is storage exhaustion or inflated cloud storage costs; no public exploit has been identified at time of analysis.
Filament's login page leaks account existence through a measurable timing side-channel, allowing unauthenticated remote attackers to enumerate registered email addresses. Versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4 of this widely-used Laravel full-stack component library are affected. The impact is confined to account enumeration - no credentials, session tokens, or other data are exposed - but the disclosed information can seed targeted phishing or credential-stuffing campaigns. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Filament is a collection of full-stack components for Laravel development. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.