CVE-2026-33080

MEDIUM EPSS 21.2%
Published Mar 20, 20263mo ago · Modified Jun 17, 20262w ago
5.4 CVSS 3.1
Medium
Find Similar
Published Mar 20, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.8.4 and 5.0.0 through 5.3.4 have two Filament Table summarizers (Range, Values) that render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers. This issue has been patched in versions 4.8.5 and 5.3.5.

CVSS Details

Base Score
5.4
Exploitability
2.3
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
21.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-79 Cross-site Scripting Injection
CWE-80

Affected Products 2

VendorProductVersionRange
filamentphpfilament*≥4.0.0  –  <4.8.5
filamentphpfilament*≥5.0.0  –  <5.3.5

References 4

  • github.com https://github.com/filamentphp/filament/commit/efa041aeeb4b1a99acd48aaa05584993c926d1ed
    Patch
  • github.com https://github.com/filamentphp/filament/releases/tag/v4.8.5
    ProductRelease Notes
  • github.com https://github.com/filamentphp/filament/releases/tag/v5.3.5
    ProductRelease Notes
  • github.com https://github.com/filamentphp/filament/security/advisories/GHSA-vv3x-j2x5-36jc
    Vendor Advisory

Remediation

  • github.com https://github.com/filamentphp/filament/commit/efa041aeeb4b1a99acd48aaa05584993c926d1ed
    Patch