Stored XSS in Filament ImageColumn and ImageEntry Components

Compliance Impact

The vulnerability CVE-2026-48167 allows stored cross-site scripting (XSS) attacks by rendering raw database values without escaping HTML in certain components of the Filament PHP framework.

Such XSS vulnerabilities can lead to unauthorized execution of malicious scripts in users' browsers, potentially exposing sensitive data or enabling unauthorized actions.

This can impact compliance with standards like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.

Failure to mitigate such vulnerabilities could result in data breaches or unauthorized data exposure, which are violations of these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Filament to version 4.11.5 or later if you are using the 4.x series, or to version 5.6.5 or later if you are using the 5.x series.

Additionally, ensure that any data passed to the ImageColumn and ImageEntry components is properly validated and sanitized to prevent malicious HTML or JavaScript from being rendered.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Filament, a set of components for Laravel development. Specifically, the ImageColumn and ImageEntry components from versions 4.0.0 up to 4.11.5 and 5.6.5 render raw database values without escaping HTML. If the data passed to these components is not properly validated, an attacker can insert malicious HTML or JavaScript code. This results in a stored cross-site scripting (XSS) vulnerability, where the malicious code executes whenever users view the affected table or schema.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow attackers to execute malicious scripts in the context of users who view the affected components. This can lead to unauthorized actions such as stealing user credentials, session hijacking, or performing actions on behalf of the user without their consent. Since the vulnerability is a stored XSS, the malicious code persists in the database and affects all users who access the compromised data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Filament PHP framework's ImageColumn and ImageEntry components rendering raw database values without escaping HTML, leading to stored XSS. Detection involves identifying if your system is running affected versions of the filament/infolists or filament/tables packages (versions >= 4.0.0 and < 4.11.5, or >= 5.0.0 and < 5.6.5).

To detect the vulnerability on your system, you can check the installed package versions using composer commands.

• Run `composer show filament/infolists` and `composer show filament/tables` to check the installed versions.
• If the versions fall within the vulnerable ranges, your system is potentially affected.

Additionally, you can scan your database or application data for suspicious HTML or JavaScript code in fields rendered by ImageColumn or ImageEntry components, which might indicate exploitation.

Useful 0 Not Useful 0