Executive brief
Filament, a popular administration panel for PHP applications, contains a vulnerability that allows unauthenticated users to upload files to temporary storage. This occurs on pages that should not normally accept files, such as the login screen. An attacker could exploit this to fill up the server's disk space or increase cloud storage costs, potentially causing a service outage.
Technical details
The vulnerability is a case of missing authorization (CWE-862) where Filament applies Livewire's `WithFileUploads` trait to components that do not require it, such as the panel login form. This exposes an endpoint for unauthenticated temporary file uploads. An attacker can send network requests to these components to upload arbitrary files into the application's temporary storage directory. While this does not directly lead to remote code execution, it can be used for denial-of-service (DoS) by exhausting disk space or to incur significant storage costs. Patches are available in versions 3.3.52, 4.11.5, and 5.6.5.
Affected products
- filamentphp filament >= 3.0.0, <= 3.3.51
- filamentphp filament >= 4.0.0, <= 4.11.4
- filamentphp filament: >= 5.0.0, <= 5.6.4
Timeline
- 2026-05-23: disclosed
- 2026-06-22: advisory: NVD publication date
- 2026-06-23: patched