CVE-2026-48167Disclosure

LOWCVSS 6.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the ImageColumn and ImageEntry components render raw database values without escaping HTML. Where the data passed to these components isn't validated, an attacker could plant malicious HTML or JavaScript and achieve stored XSS that executes for users who view the table or schema. This vulnerability is fixed in 4.11.5 and 5.6.5.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/filamentphp/filament/security/advisories/GHSA-3fc8-8hp6-6jr4

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-06-22); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-22	2	Disclosure2
2026-06-23	1	Disclosure1

Full discourse3 posts

Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-48167 Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the ImageColumn and ImageEntry components re… https://www.cve.org/CVERecord?id=CVE-2026-48167 ----- Traducción: CVE-2026-48167 Fil… http://infoflow.cloud`
Post summary
The post announces CVE-2026-48167, listing affected component versions, but provides no proof of concept, exploit code, active exploitation evidence, or patch details.
1000051
88 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-48167 Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the ImageColumn and ImageEntry components re… https://www.cve.org/CVERecord?id=CVE-2026-48167
Post summary
The tweet briefly references CVE-2026-48167, noting affected Filament components and version ranges, but provides no specific technical details, PoC, or patch information.
00010998
57.7K followersView on X
DailyCVE@dailycve90d
Disclosure
🟠 Filament (Laravel), Stored XSS via Unescaped ImageColumn/ImageEntry, #CVE-2026-48167 (Moderate severity) -DC-Jun2026-610 https://dailycve.com/filament-laravel-stored-xss-via-unescaped-imagecolumn-imageentry-cve-2026-48167-moderate-severity-dc-jun2026-610/
Post summary
The text announces a moderate severity Stored XSS vulnerability in Filament (Laravel) that occurs through unescaped ImageColumn/ImageEntry, providing technical details but no PoC, exploit code, or patch.
0000043
216 followersView on X

Explore more

Back to dashboard