CVE-2026-48167: Filament stored XSS in ImageColumn and ImageEntry components

CVE-2026-48167 · Severity: medium · CVSS 6.4 · Published 2026-06-22

Filament is a popular framework for building administration panels and dashboards in PHP. A vulnerability in its image display components allows attackers to inject malicious scripts into the database. When other users, such as administrators, view these images in a table or list, the scripts could execute in their browser, potentially leading to unauthorized actions or data theft.

Technologies: filament/tables (Packagist). Vendors: Filament, Packagist.

Quick answers

Is CVE-2026-48167 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48167 being exploited in the wild.
How severe is CVE-2026-48167?
Medium severity, with a CVSS score of 6.4, published 22 June 2026.
Which products and versions are affected?
Filament Infolists >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5, >= 4.0.0, <= 4.11.4; >= 5.0.0, <= 5.6.4; filament/infolists (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.11.5; filament/tables (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.11.5.
Is there a fix for CVE-2026-48167?
Yes. filament/infolists (Packagist): upgrade to 4.11.5 or later; filament/tables (Packagist): upgrade to 4.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48167 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48167?
Check whether you run Filament Infolists, filament/infolists (Packagist) or filament/tables (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • filament/infolists (Packagist): upgrade to 4.11.5 or later
    composer require filament/infolists:^4.11.5
  • filament/tables (Packagist): upgrade to 4.11.5 or later
    composer require filament/tables:^4.11.5

Technical details

The vulnerability is a stored Cross-Site Scripting (XSS) flaw (CWE-79) within the ImageColumn and ImageEntry components of the Filament ecosystem. These components fail to properly escape HTML when rendering raw values retrieved from the database. An attacker with the ability to write data to fields rendered by these components can inject malicious HTML or JavaScript. The exploit occurs when a user views a table or schema containing the malicious entry; because the 'Scope' is changed (S:C) in the CVSS metric, the script can execute in the context of the administrative interface. The issue is fixed in versions 4.11.5 and 5.6.5.

Affected products

  • Filament filament/infolists >= 4.0.0, <= 4.11.4; >= 5.0.0, <= 5.6.4
  • Filament filament/tables >= 4.0.0, <= 4.11.4; >= 5.0.0, <= 5.6.4

Identifiers

  • CVE-2026-48167
  • GHSA-3fc8-8hp6-6jr4

Timeline

  • 2026-05-23: disclosed
  • 2026-06-22: advisory: NVD publication date
  • 2026-06-23: patched: GitHub Advisory published and reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.