Security: filamentphp/filament
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Disabled RichEditor field state can be used for XSSGHSA-m9cv-24rx-8mv7 published
Jun 17, 2026 by danharrinHigh -
Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submissionGHSA-mc5j-f6wx-h9qh published
May 23, 2026 by danharrinHigh -
Timing-based user enumeration on login pageGHSA-5w46-g9pq-wh6f published
May 23, 2026 by danharrinModerate -
Unvalidated ImageColumn and ImageEntry values can be used for XSSGHSA-3fc8-8hp6-6jr4 published
May 23, 2026 by danharrinModerate -
Unauthenticated temporary file upload on auth pagesGHSA-44wp-g8f4-f4v5 published
May 23, 2026 by danharrinModerate -
Inconsistent scope enforcement for AttachAction and AssociateAction Select fieldsGHSA-7q3w-xqjw-g3cr published
May 23, 2026 by danharrinModerate -
Unvalidated Range and Values summarizer values can be used for XSSGHSA-vv3x-j2x5-36jc published
Mar 18, 2026 by danharrinHigh -
Multi-factor authentication (app) recovery codes can be used multiple timesGHSA-pvcv-q3q7-266g published
Dec 9, 2025 by danharrinHigh -
Exported files stored in default (public) filesystem if not reconfiguredGHSA-4hxw-gc2q-f6f3 published
Nov 7, 2024 by danharrinLow -
Unvalidated ColorColumn and ColorEntry values can be used for XSSGHSA-9h9q-qhxg-89xr published
Sep 27, 2024 by danharrinCritical