CVE-2026-48167
CVE-2026-48167 · Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the ImageColumn and ImageEntry components render raw database values without escaping HTML. Where the data passed to these components isn't validated, an attacker could plant malicious HTML or JavaScript and achieve stored XSS that executes for users who view the table or schema. This vulnerability is fixed in 4.11.5 and 5.6.5.
CVSS 6.4 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
filament
- Versions
- >= 4.0.0, < 4.11.5: Affected
- >= 5.0.0, < 5.6.5: Affected
No fix published
filament/infolists Packagist
- Versions
- v4.0.0
- v4.0.1
- v4.0.10
- v4.0.11
- v4.0.12
- v4.0.13
- v4.0.14
- v4.0.15
- v4.0.16
- v4.0.17
- v4.0.18
- v4.0.19
- v4.0.2
- v4.0.20
- v4.0.3
- v4.0.4
- v4.0.5
- v4.0.6
- v4.0.7
- v4.0.8
- v4.0.9
- v4.1.0
- v4.1.1
- v4.1.10
- v4.1.2
- v4.1.3
- v4.1.4
- v4.1.5
- v4.1.6
- v4.1.7
- v4.1.8
- v4.1.9
- v4.10.0
- v4.10.1
- v4.10.2
- v4.11.0
- v4.11.1
- v4.11.2
- v4.11.3
- v4.11.4
- v4.2.0
- v4.2.1
- v4.2.2
- v4.2.3
- v4.2.4
- v4.3.0
- v4.3.1
- v4.4.0
- v4.5.0
- v4.5.1
- v4.5.2
- v4.5.3
- v4.6.0
- v4.6.1
- v4.6.2
- v4.6.3
- v4.7.0
- v4.7.1
- v4.7.2
- v4.7.3
- v4.7.4
- v4.8.0
- v4.8.1
- v4.8.2
- v4.8.3
- v4.8.4
- v4.8.5
- v4.9.0
- v4.9.1
- v4.9.2
- v4.9.3
- v4.9.4
- v4.9.5
- Affected ranges
- ECOSYSTEM: ≥ 4.0.0, < 4.11.5
Update to 4.11.5
filament/tables Packagist
- Versions
- v4.0.0
- v4.0.1
- v4.0.10
- v4.0.11
- v4.0.12
- v4.0.13
- v4.0.14
- v4.0.15
- v4.0.16
- v4.0.17
- v4.0.18
- v4.0.19
- v4.0.2
- v4.0.20
- v4.0.3
- v4.0.4
- v4.0.5
- v4.0.6
- v4.0.7
- v4.0.8
- v4.0.9
- v4.1.0
- v4.1.1
- v4.1.10
- v4.1.2
- v4.1.3
- v4.1.4
- v4.1.5
- v4.1.6
- v4.1.7
- v4.1.8
- v4.1.9
- v4.10.0
- v4.10.1
- v4.10.2
- v4.11.0
- v4.11.1
- v4.11.2
- v4.11.3
- v4.11.4
- v4.2.0
- v4.2.1
- v4.2.2
- v4.2.3
- v4.2.4
- v4.3.0
- v4.3.1
- v4.4.0
- v4.5.0
- v4.5.1
- v4.5.2
- v4.5.3
- v4.6.0
- v4.6.1
- v4.6.2
- v4.6.3
- v4.7.0
- v4.7.1
- v4.7.2
- v4.7.3
- v4.7.4
- v4.8.0
- v4.8.1
- v4.8.2
- v4.8.3
- v4.8.4
- v4.8.5
- v4.9.0
- v4.9.1
- v4.9.2
- v4.9.3
- v4.9.4
- v4.9.5
- Affected ranges
- ECOSYSTEM: ≥ 4.0.0, < 4.11.5
Update to 4.11.5
filament/infolists Packagist
- Versions
- v5.0.0
- v5.1.0
- v5.1.1
- v5.1.2
- v5.1.3
- v5.2.0
- v5.2.1
- v5.2.2
- v5.2.3
- v5.2.4
- v5.3.0
- v5.3.1
- v5.3.2
- v5.3.3
- v5.3.4
- v5.3.5
- v5.4.0
- v5.4.1
- v5.4.2
- v5.4.3
- v5.4.4
- v5.4.5
- v5.5.0
- v5.5.1
- v5.5.2
- v5.6.0
- v5.6.1
- v5.6.2
- v5.6.3
- v5.6.4
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.6.5
Update to 5.6.5
filament/tables Packagist
- Versions
- v5.0.0
- v5.1.0
- v5.1.1
- v5.1.2
- v5.1.3
- v5.2.0
- v5.2.1
- v5.2.2
- v5.2.3
- v5.2.4
- v5.3.0
- v5.3.1
- v5.3.2
- v5.3.3
- v5.3.4
- v5.3.5
- v5.4.0
- v5.4.1
- v5.4.2
- v5.4.3
- v5.4.4
- v5.4.5
- v5.5.0
- v5.5.1
- v5.5.2
- v5.6.0
- v5.6.1
- v5.6.2
- v5.6.3
- v5.6.4
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.6.5
Update to 5.6.5