Advisory Database
  • Advisories
  • Dependency Scanning
  1. composer
  2. ›
  3. filament/tables
  4. ›
  5. CVE-2026-33080

CVE-2026-33080: Filament Unvalidated Range and Values summarizer values can be used for XSS

March 18, 2026 (updated March 20, 2026)

Two Filament Table summarizers (Range, Values) render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers.

References

  • github.com/advisories/GHSA-vv3x-j2x5-36jc
  • github.com/filamentphp/filament
  • github.com/filamentphp/filament/commit/efa041aeeb4b1a99acd48aaa05584993c926d1ed
  • github.com/filamentphp/filament/releases/tag/v4.8.5
  • github.com/filamentphp/filament/releases/tag/v5.3.5
  • github.com/filamentphp/filament/security/advisories/GHSA-vv3x-j2x5-36jc
  • nvd.nist.gov/vuln/detail/CVE-2026-33080

Code Behaviors & Features

Detect and mitigate CVE-2026-33080 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 4.0.0 before 4.8.5, all versions starting from 5.0.0 before 5.3.5

Fixed versions

  • 4.8.5
  • 5.3.5

Solution

Upgrade to versions 4.8.5, 5.3.5 or above.

Impact 7.3 HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Source file

packagist/filament/tables/CVE-2026-33080.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 24 Mar 2026 12:17:15 +0000.