Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-33080 is a vulnerability in the Filament PHP framework affecting the Table package\'s summarizer components named "Range" and "Values." These summarizers render raw database values without escaping HTML, which means that if the data in the columns using these summarizers is not properly validated, an attacker can inject malicious HTML or JavaScript code.'}, {'type': 'paragraph', 'content': 'This injection leads to a stored Cross-Site Scripting (XSS) attack, where the malicious script executes in the browsers of users who view the affected tables. The vulnerability arises because special characters like <, >, and & are not properly escaped or neutralized, allowing script execution within the web page context.'}, {'type': 'paragraph', 'content': 'The issue has been fixed in Filament versions 4.8.5 and 5.3.5 by escaping the output in these summarizers to prevent unescaped HTML from being rendered.'}] [4, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious security impacts if exploited. An attacker who can insert malicious HTML or JavaScript into the database columns used by the vulnerable summarizers can execute stored XSS attacks.

When users view the affected tables, the malicious script runs in their browsers, potentially allowing the attacker to steal sensitive information, hijack user sessions, modify displayed content, or perform actions on behalf of the user.

The CVSS score of 7.3 indicates a high severity, with impacts including high confidentiality and integrity risks, although availability is not affected.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves unescaped HTML rendering in the Filament Table summarizers "Range" and "Values" in affected versions. Detection involves identifying if your system is running a vulnerable version of the Filament PHP framework (versions 4.0.0 through 4.8.4 or 5.0.0 through 5.3.4) and if any tables use these summarizers without proper data validation.'}, {'type': 'paragraph', 'content': 'Since the vulnerability is related to stored XSS via database values rendered without escaping, you can detect it by checking the version of the filament/tables package installed and inspecting tables that use the Range or Values summarizers for unescaped HTML content.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect the vulnerable version on your system include:'}, {'type': 'list_item', 'content': 'Check the installed version of filament/tables via Composer: composer show filament/tables'}, {'type': 'list_item', 'content': "Search your codebase for usage of the Range and Values summarizers in tables, for example using grep: grep -r 'Range' path/to/your/project"}, {'type': 'list_item', 'content': 'Inspect database columns used by these summarizers for any suspicious or unescaped HTML content.'}, {'type': 'paragraph', 'content': 'There are no specific network commands or automated detection tools mentioned in the provided resources.'}] [4]

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the Filament PHP framework to a patched version where this vulnerability is fixed.

• Upgrade to version 4.8.5 or later if you are on the 4.x branch.
• Upgrade to version 5.3.5 or later if you are on the 5.x branch.

These versions include fixes that escape the output in the Range and Values summarizers to prevent unescaped HTML rendering and thus mitigate stored XSS attacks.

Additionally, ensure that any data used in these summarizers is properly validated and sanitized before being stored or displayed.

Useful 0 Not Useful 0