CVE-2026-48500: Filament unauthenticated temporary file upload in auth components

CVE-2026-48500 · Severity: medium · CVSS 6.5 · Published 2026-06-22

Filament, a popular administration panel for PHP applications, contains a vulnerability that allows unauthenticated users to upload files to temporary storage. This occurs on pages that should not normally accept files, such as the login screen. An attacker could exploit this to fill up the server's disk space or increase cloud storage costs, potentially causing a service outage.

Technologies: Filament, filament/filament (Packagist). Vendors: Filament, Packagist.

Quick answers

Is CVE-2026-48500 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48500 being exploited in the wild.
How severe is CVE-2026-48500?
Medium severity, with a CVSS score of 6.5, published 22 June 2026.
Which products and versions are affected?
Filament >= 3.0.0, < 3.3.52; >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5; filament/filament (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.11.5.
Is there a fix for CVE-2026-48500?
Yes. filament/filament (Packagist): upgrade to 4.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48500 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48500?
Check whether you run Filament or filament/filament (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • filament/filament (Packagist): upgrade to 4.11.5 or later
    composer require filament/filament:^4.11.5

Technical details

The vulnerability is a case of missing authorization (CWE-862) where Filament applies Livewire's `WithFileUploads` trait to components that do not require it, such as the panel login form. This exposes an endpoint for unauthenticated temporary file uploads. An attacker can send network requests to these components to upload arbitrary files into the application's temporary storage directory. While this does not directly lead to remote code execution, it can be used for denial-of-service (DoS) by exhausting disk space or to incur significant storage costs. Patches are available in versions 3.3.52, 4.11.5, and 5.6.5.

Affected products

  • filamentphp filament >= 3.0.0, <= 3.3.51
  • filamentphp filament >= 4.0.0, <= 4.11.4
  • filamentphp filament: >= 5.0.0, <= 5.6.4

Identifiers

  • CVE-2026-48500
  • GHSA-44wp-g8f4-f4v5

Timeline

  • 2026-05-23: disclosed
  • 2026-06-22: advisory: NVD publication date
  • 2026-06-23: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.