Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-48500 EUVD-2026-38394GHSA-44wp-g8f4-f4v5

Filament: Unauthenticated temporary file upload on auth pages

Published Jun 22, 2026 · Updated Jun 23, 2026 · Assigned by GitHub_M

Vendor: filamentphp Product: filament Package: filament/filament Ecosystem: Packagist

Description

Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component the schema is embedded in. However, some schemas, such as the panel login form, do not require file uploads, and exposing unauthenticated temporary file uploads on these components is not an acceptable risk. On these components, an unauthenticated attacker could upload arbitrary files to the application's temporary storage, which could be abused to exhaust disk space or inflate storage costs. This vulnerability is fixed in 3.3.52, 4.11.5, and 5.6.5.

Affected products

VendorProductAffectedFixed
filamentphp filament >= 3.0.0, < 3.3.52, >= 5.0.0, < 5.6.5, >= 4.0.0, < 4.11.5 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist filament/filament >= 4.0.0, < 4.11.5 4.11.5 GHSA-44wp-g8f4-f4v5
Packagist filament/filament >= 5.0.0, < 5.6.5 5.6.5 GHSA-44wp-g8f4-f4v5
Packagist filament/filament >= 3.0.0, < 3.3.52 3.3.52 GHSA-44wp-g8f4-f4v5

References