7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33080

CVE-2026-33080: Filament: Unvalidated Range and Values summarizer values can be used for XSS

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.8.4 and 5.0.0 through 5.3.4 have two Filament Table summarizers (Range, Values) that render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers. This issue has been patched in versions 4.8.5 and 5.3.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33080

CVE-2026-33080:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
filament/tables	composer	>= 4.0.0, < 4.8.5	4.8.5
filament/tables	composer	>= 5.0.0, < 5.3.5	5.3.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the vulnerability is the lack of output escaping in the toEmbeddedHtml methods of the Range and Values table summarizers in the filament/tables package. These summarizers are used to display aggregate data from table columns. When data from the database is rendered, it was not sanitized or escaped, allowing raw HTML and JavaScript to be injected into the page. An attacker could exploit this by storing a malicious payload (e.g., <script>alert(1)</script>) in a database field that is then summarized by one of the vulnerable components. When a user views the table containing the summarizer, the malicious script would execute in their browser, leading to a stored Cross-Site Scripting (XSS) attack. The patch for this vulnerability, found in commit bbc365bbe60a31ddc6f730657266f5bce130cc75, applies the e() helper function, which is Laravel's wrapper for htmlspecialchars, to escape the output and prevent the browser from interpreting it as active content. The analysis of the patch shows that while the advisory specifically mentions the Range and Values summarizers, several other components were also patched for similar XSS flaws in the same commit, indicating a wider effort to secure the library against this type of vulnerability.

Vulnerable functions

Filament\Tables\Columns\Summarizers\Range::toEmbeddedHtml

packages/tables/src/Columns/Summarizers/Range.php

The `toEmbeddedHtml` function in the `Range` summarizer renders the `$from` and `$to` values, which are derived from database data, without proper HTML escaping. This allows an attacker who can control the data in the summarized column to inject malicious HTML and JavaScript, leading to a stored Cross-Site Scripting (XSS) vulnerability.

Filament\Tables\Columns\Summarizers\Values::toEmbeddedHtml

packages/tables/src/Columns/Summarizers/Values.php

The `toEmbeddedHtml` function in the `Values` summarizer iterates over state items and renders them using `formatState`. The output of `formatState` was not escaped before being rendered into the HTML. This allows an attacker who can control the data in the summarized column to inject malicious HTML and JavaScript, leading to a stored Cross-Site Scripting (XSS) vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.