PT-2026-26189 · Filament · Filament

Danharrin · Published 2026-03-18 · Updated 2026-03-22 · CVE-2026-33080

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.8.4 Filament versions 5.0.0 through 5.3.4

Description Filament is a collection of full-stack components for accelerated Laravel development. The Table summarizers (Range, Values) render raw database values without escaping HTML. If data validation is lacking in columns utilizing these summarizers, an attacker could inject malicious HTML or JavaScript, leading to stored cross-site scripting (XSS) that executes for users viewing the table. The vulnerable components are the Range and Values summarizers.

Recommendations Filament versions 4.0.0 through 4.8.4 should be updated to version 4.8.5 or later. Filament versions 5.0.0 through 5.3.4 should be updated to version 5.3.5 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2026-33080

GHSA-VV3X-J2X5-36JC

Affected Products

Filament

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33080.json · Exploit
• https://github.com/filamentphp/filament/commit/efa041aeeb4b1a99acd48aaa05584993c926d1ed · Patch
• https://github.com/filamentphp/filament/security/advisories/GHSA-vv3x-j2x5-36jc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33080 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33080 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vv3x-j2x5-36jc · Vendor Advisory
• https://github.com/filamentphp/filament · Note
• https://github.com/filamentphp/filament/releases/tag/v4.8.5 · Note
• https://github.com/filamentphp/filament/releases/tag/v5.3.5 · Note
• https://twitter.com/VulmonFeeds/status/2035013075720442103 · Twitter Post
• https://twitter.com/CVEnew/status/2035627001927610692 · Twitter Post