CVE-2026-48167: Filament Packages Vulnerability Leading to XSS via Unvalidated ImageColumn and ImageEntry
Summary
CVE-2026-48167: Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS. Affects filament/infolists across 2 version ranges.
>= 4.0.0, < 4.11.5
>= 5.0.0, < 5.6.5
Fixed in 4.11.5 or 5.6.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Filament is a popular open-source package for building admin panels in PHP applications. It provides components like ImageColumn and ImageEntry that allow developers to display images and other media in their applications. However, these components have a critical vulnerability that allows unvalidated database values to be rendered as raw HTML, making them susceptible to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the ImageColumn and ImageEntry components rendering raw database values without proper HTML escaping. If an attacker can insert malicious HTML or JavaScript into the database, this code will execute in the browsers of users viewing the affected tables or schemas. This can lead to data theft, session hijacking, or other malicious actions. The vulnerability affects versions of the filament/infolists and filament/tables packages prior to 4.11.5 and 5.6.5 respectively.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.11.54.11.5composer require filament/infolists:4.11.5 -
>= 5.0.0, < 5.6.55.6.5composer require filament/infolists:5.6.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, validate and sanitize any user input before storing it in the database. This can prevent malicious scripts from being injected. Additionally, consider escaping output when rendering data in the ImageColumn and ImageEntry components.
Conclusion
In summary, the CVE-2026-48167 vulnerability in Filament packages allows for XSS attacks due to unvalidated rendering of database values. It is crucial to update to the latest patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for filament/infolists →
FAQ
The CVSS score of this vulnerability is 6.4, indicating a moderate severity level.
Versions of filament/infolists and filament/tables prior to 4.11.5 and 5.6.5 respectively are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include data theft, session hijacking, and other malicious actions that can compromise user security.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just the composer.lock file, providing real-time insights.
