CVE-2026-48500

Filament: Unauthenticated temporary file upload on auth pages

Published Jun 22, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component the schema is embedded in. However, some schemas, such as the panel login form, do not require file uploads, and exposing unauthenticated temporary file uploads on these components is not an acceptable risk. On these components, an unauthenticated attacker could upload arbitrary files to the application's temporary storage, which could be abused to exhaust disk space or inflate storage costs. This vulnerability is fixed in 3.3.52, 4.11.5, and 5.6.5.

Analysis

Technical impact

A vulnerability in Filament allows an unauthenticated attacker to upload arbitrary files to the application's temporary storage via schema‑based file upload forms present on authentication pages. The uploaded data can be used to consume disk space rapidly or inflate storage costs, effectively causing a denial‑of‑service or financial impact. The weakness is rooted in missing access control over temporary uploads and is classified as an authorization failure.

Affected Systems

The affected package is Filament, a collection of front‑end components for Laravel. Versions 3.0.0 through 3.3.52, 4.11.5, and 5.6.5 are vulnerable. The bug is present in any schema that contains a file upload field, even when the form does not logically require uploads, such as the panel login form.

Risk and Exploitability

The CVSS score is 6.5, indicating a moderate severity. Since no exploit is publicly available and the EPSS score is not reported, the likelihood of exploitation is uncertain but non‑zero. The issue is not listed in the CISA KEV catalog. An attacker would need only unauthenticated access to the login or other authentication pages with a schema that includes a file upload field; no additional privileges or injection vectors are required.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

filamentphp

filament

affected

Version	Status	Constraints
`>= 3.0.0, < 3.3.52`	affected	—
`>= 5.0.0, < 5.6.5`	affected	—
`>= 4.0.0, < 4.11.5`	affected	—

No data.

Vendor Product Versions

Filamentphp

Filament

Version	Status	Scheme	Platform
`[3.0.0,3.3.52)`	affected	semver	—
`[5.0.0,5.6.5)`	affected	semver	—
`[4.0.0,4.11.5)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Filament to a patched release: 3.3.52 or newer, 4.11.5 or newer, or 5.6.5 or newer
If upgrading is not immediately possible, disable file uploads on authentication components by removing the file field from the schema or by disabling the WithFileUploads trait for those Livewire components
Set limits or cleanup routines on the temporary storage directory to prevent disk exhaustion or cost escalation

Generated by OpenCVE AI on June 22, 2026 at 23:24 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-44wp-g8f4-f4v5	Filament: Unauthenticated temporary file upload on auth pages

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.343% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/filamentphp/filament/security/advisories/GHSA-44wp-g8f4-f4v5

History

Jun 23, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 23, 2026 1:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Filamentphp Filamentphp filament
Vendors & Products		Filamentphp Filamentphp filament

Jun 22, 2026 10:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component the schema is embedded in. However, some schemas, such as the panel login form, do not require file uploads, and exposing unauthenticated temporary file uploads on these components is not an acceptable risk. On these components, an unauthenticated attacker could upload arbitrary files to the application's temporary storage, which could be abused to exhaust disk space or inflate storage costs. This vulnerability is fixed in 3.3.52, 4.11.5, and 5.6.5.
Title		Filament: Unauthenticated temporary file upload on auth pages
Weaknesses		CWE-862
References		https://github.com/filamentphp/filament/security/advisories/GHSA-44wp-g8f4-f4v5
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}`