CVE-2026-55409
Filament: Disabled RichEditor field state can be used for XSS
CVSS Score
7.6
EPSS Score
0.0%
EPSS Percentile
0th
Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. This vulnerability is fixed in 3.3.53.
| CWE | CWE-79 |
| Vendor | filamentphp |
| Product | filament |
| Published | Jun 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for filamentphp filament
Be the first to know when new high vulnerabilities affecting filamentphp filament are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
filamentphp / filament
>= 3.0.0, < 3.3.53