Cross-Site Scripting Flaw in Filament by Laravel
CVE-2026-55409

7.6HIGH

Key Information:

Vendor

FilamentPHP

Status
Filament
Vendor
CVE Published:
22 June 2026

What is CVE-2026-55409?

Filament, a collection of components designed to enhance Laravel development, harbors a vulnerability that allows an unfiltered RichEditor field to display its raw content without proper HTML sanitization. This flaw exists in versions 3.0.0 through 3.3.53. Unsanitized data stored in this field can be leveraged by attackers to insert malicious HTML or JavaScript. Consequently, when users access forms that utilize this field, the injected scripts can execute, posing significant security risks. This issue has been addressed in version 3.3.53.

Affected Version(s)

filament >= 3.0.0, < 3.3.53

References

https://github.com/filamentphp/filament/security/advisori...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.