CVE-2026-55409: high-severity vulnerability in filamentphp filament
Filament: Disabled RichEditor field state can be used for XSS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.6epss 0.4%
Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. This vulnerability is fixed in 3.3.53.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Affected products
filamentphp · filamentRelated CVEs — filamentphp filament
In the same product, most dangerous first.
CVE-2024-51758LOWExported files stored in default (`public`) filesystem if not reconfigured in filamentEPSS 0.6%CVE-2026-77567HIGHFilament: App-based MFA can be bypassed when recovery codes are enabledEPSS 0.6%CVE-2026-84307LOWFilament: Password validity disclosure for accounts denied panel access on login pageEPSS 0.5%CVE-2026-84306MEDIUMFilament: Multi-factor authentication (app) codes can still be used after a newer code has been usedEPSS 0.4%CVE-2024-47186MEDIUMFilament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site ScriptingEPSS 0.4%CVE-2025-67507HIGHFilament's multi-factor authentication (app) recovery codes can be used multiple timesEPSS 0.4%