Log in Start free

Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-33080Filament: Unvalidated Range and Values summarizer values can be used for XSS

High 7.3

In plain English

A high-severity cross-site scripting in filament from filamentphp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 76.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.8.4 and 5.0.0 through 5.3.4 have two Filament Table summarizers (Range, Values) that render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers. This issue has been patched in versions 4.8.5 and 5.3.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistfilament/tables4.8.5GHSA-vv3x-j2x5-36jc
Packagistfilament/tables5.3.5GHSA-vv3x-j2x5-36jc

Affected products (as reported)

VendorProductVersions
filamentphp filament >= 4.0.0, < 4.8.5>= 5.0.0, < 5.3.5

Weakness: CWE-79, CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References