CVE-2026-33080: Filament Tables stored XSS in Range and Values summarizers

Executive brief

Filament is a popular framework for building administration panels and dashboards in Laravel applications. A security flaw in the table summarization feature allows malicious code to be stored in the database and executed in the browsers of other users. This could lead to unauthorized actions being performed on behalf of administrators or the theft of sensitive session information.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Filament Tables package. The 'Range' and 'Values' summarizer components render raw database values directly to the page without proper HTML escaping. An attacker with the ability to insert data into columns monitored by these summarizers can inject malicious HTML or JavaScript. The payload executes when a user views the table summary. This issue is fixed in versions 4.8.5 and 5.3.5.

Affected products

• filamentphp filament/tables >= 4.0.0, < 4.8.5; >= 5.0.0, < 5.3.5

Timeline

• 2026-03-18: advisory: GitHub Advisory published
• 2026-03-18: disclosed
• 2026-03-20: advisory: NVD published

References

• https://api.github.com/users/danharrin
• https://github.com/danharrin
• https://api.github.com/users/danharrin/gists%7B/gist_id%7D
• https://api.github.com/users/danharrin/repos
• https://avatars.githubusercontent.com/u/41773797?v=4
• https://api.github.com/users/danharrin/events%7B/privacy%7D