A vulnerability in Filament allows an unauthenticated attacker to upload arbitrary files to the application's temporary storage via schema‑based file upload forms present on authentication pages. The uploaded data can be used to consume disk space rapidly or inflate storage costs, effectively causing a denial‑of‑service or financial impact. The weakness is rooted in missing access control over temporary uploads and is classified as an authorization failure.

The affected package is Filament, a collection of front‑end components for Laravel. Versions 3.0.0 through 3.3.52, 4.11.5, and 5.6.5 are vulnerable. The bug is present in any schema that contains a file upload field, even when the form does not logically require uploads, such as the panel login form.

The CVSS score is 6.5, indicating a moderate severity. Since no exploit is publicly available and the EPSS score is not reported, the likelihood of exploitation is uncertain but non‑zero. The issue is not listed in the CISA KEV catalog. An attacker would need only unauthenticated access to the login or other authentication pages with a schema that includes a file upload field; no additional privileges or injection vectors are required.