PT-2026-26189 · Filament · Filament

Danharrin · Publicado 2026-03-18 · Atualizado 2026-03-22 · CVE-2026-33080

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.8.4 Filament versions 5.0.0 through 5.3.4

Description Filament is a collection of full-stack components for accelerated Laravel development. The Table summarizers (Range, Values) render raw database values without escaping HTML. If data validation is lacking in columns utilizing these summarizers, an attacker could inject malicious HTML or JavaScript, leading to stored cross-site scripting (XSS) that executes for users viewing the table. The vulnerable components are the Range and Values summarizers.

Recommendations Filament versions 4.0.0 through 4.8.4 should be updated to version 4.8.5 or later. Filament versions 5.0.0 through 5.3.4 should be updated to version 5.3.5 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-80

CWE-79

Identificadores relacionados

CVE-2026-33080

GHSA-VV3X-J2X5-36JC

Produtos afetados

Filament

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33080.json · Exploit
• https://github.com/filamentphp/filament · Nota
• https://github.com/filamentphp/filament/releases/tag/v4.8.5 · Nota
• https://github.com/filamentphp/filament/commit/efa041aeeb4b1a99acd48aaa05584993c926d1ed · Correção
• https://github.com/filamentphp/filament/security/advisories/GHSA-vv3x-j2x5-36jc · Aviso do Fabricante
• https://github.com/filamentphp/filament/releases/tag/v5.3.5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-33080 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2035013075720442103 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035627001927610692 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33080 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-vv3x-j2x5-36jc · Aviso do Fabricante