Executive brief
Filament Comments is a PHP package that adds commenting functionality to Filament admin panels. The vulnerability allows authenticated panel users to inject malicious scripts into comment bodies that execute in the browsers of other users, including administrators, enabling session token theft and account takeover.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the comment body rendering logic of filament-comments. The vulnerable code in comments.blade.php uses unsafe HTML rendering (toHtmlString()) without proper sanitization, allowing authenticated users to inject arbitrary JavaScript payloads that persist in the database. When other users (including administrators) view comments, the malicious scripts execute in their browsers in the context of the admin panel, potentially allowing attackers to steal session tokens or perform unauthorized actions. The vulnerability affects versions through 3.0.0 and requires authentication to exploit, though the threat model includes compromised low-privilege panel accounts.
Affected products
- Parallax filament-comments through 3.0.0
Timeline
- 2026-09-14: disclosed