CVE-2026-48167

MediumCVSS 6.4/10Last modified Oct 25, 2026

Description

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the ImageColumn and ImageEntry components render raw database values without escaping HTML. Where the data passed to these components isn't validated, an attacker could plant malicious HTML or JavaScript and achieve stored XSS that executes for users who view the table or schema. This vulnerability is fixed in 4.11.5 and 5.6.5.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
filamentphpfilament>= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5

References

Timeline

Published
Jun 22, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-4816810.0PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command inCVE-2026-481698.8PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that togetherCVE-2026-48176.5The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to Time-based Blind SQL Injection vCVE-2026-481709.1`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whosCVE-2026-481729.8LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. DetectioCVE-2026-481739.8In the NAS message handler, improper validation of the length field in NAS message causes memory corruptionCVE-2026-481749.8In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condiCVE-2026-481755.5Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.CVE-2026-481767.5A memory corruption vulnerability caused by improper validation of messagesCVE-2026-481788.8Out of bound access in PPC due to race condition in global variable accessCVE-2026-481797.5In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of ServiceCVE-2026-48188.1In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute so