Threat Intelligence Database

Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. This vulnerability is fixed in 3.3.53.

A race condition vulnerability exists in filamentphp's filament affecting versions from 4.0.0 up to but not including 4.11.5 and 5.6.5. The flaw allows reuse of app-based multi-factor authentication recovery codes via concurrent submissions, enabling multiple authenticated sessions per recovery code. This issue only applies when recovery codes are enabled and does not affect email-based MFA. The vulnerability is fixed in versions 4.11.5 and 5.6.5.

A missing authorization vulnerability in filamentphp's Filament allows unauthenticated attackers to upload arbitrary files to temporary storage via certain components that do not require file uploads, such as the panel login form. This can lead to resource exhaustion or increased storage costs. The issue affects versions from 3.0.0 up to but not including 3.3.52, 4.11.5, and 5.6.5, where it has been fixed.

FilamentPHP's filament package versions from 4.0.0 up to but not including 4.11.5, and from versions before 5.6.5, contain a stored cross-site scripting (XSS) vulnerability. The ImageColumn and ImageEntry components render raw database values without escaping HTML, allowing attackers to inject malicious scripts if input validation is insufficient. This vulnerability is fixed starting in versions 4.11.5 and 5.6.5.

FilamentPHP filament versions from 4.0.0 up to but not including 4.11.5 and 5.6.5 contain a timing discrepancy vulnerability on the login page. This flaw allows unauthenticated attackers to enumerate registered email addresses by observing response time differences. The vulnerability only discloses account existence information and does not impact confidentiality, integrity, or availability beyond that. It is fixed starting from versions 4.11.5 and 5.6.5.