Filament’s ImageColumn and ImageEntry components render raw database values without escaping HTML. This flaw allows an attacker to insert malicious markup or JavaScript that is stored in the database and later presented to any user who views the table or schema. The resulting stored XSS can lead to session hijacking, credential theft, or other arbitrary‑client‑side code execution, and the weakness is a classic HTML injection flaw (CWE‑79).

The vulnerability affects the filamentphp/filament component library. All versions from 4.0.0 up to and including 4.11.4 as well as every 5.x release prior to 5.6.5 are impacted. The flaw is resolved in 4.11.5 and in 5.6.5.

The CVSS score of 6.4 classifies it as a moderate‑severity vulnerability. No EPSS data is published, and the flaw is not listed in the CISA KEV catalog. Attackers would need the ability to write data that flows into ImageColumn or ImageEntry – typically by creating or editing database records through the web interface – and then convince an end‑user to view the affected table. Because the payload is stored server‑side, any authenticated user who views the table can be impacted.