XSS in Filamentphp Filament
CVE-2026-33080
Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.8.4 and 5.0.0 through 5.3.4 have two Filament Table summarizers (Range, Values) that render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers. This issue has been patched in versions 4.8.5 and 5.3.5.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (27.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 27.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
- Filamentphp Filament — versions >= 4.0.0, < 4.8.5, >= 5.0.0, < 5.3.5
Weakness classification (CWE)
References
- github.com/filamentphp/filament/security/advisories/GHSA-vv3x-j2x5-36jc (Vendor Advisory)
- github.com/filamentphp/filament/commit/efa041aeeb4b1a99acd48aaa05584993c926d1ed (Patch)
- github.com/filamentphp/filament/releases/tag/v4.8.5 (Product, Release Notes)
- github.com/filamentphp/filament/releases/tag/v5.3.5 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-33080?
- CVE-2026-33080 is a high-severity vulnerability in Filamentphp Filament, classified under Cross-site Scripting. CVSS score: 7.3/10. Published 2026-03-20.
- How severe is CVE-2026-33080?
- High severity. CVSS v3 base score is 7.3 out of 10.