6.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48167

CVE-2026-48167: Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the ImageColumn and ImageEntry components render raw database values without escaping HTML. Where the data passed to these components isn't validated, an attacker could plant malicious HTML or JavaScript and achieve stored XSS that executes for users who view the table or schema. This vulnerability is fixed in 4.11.5 and 5.6.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48167

CVE-2026-48167:

6.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
filament/infolists	composer	>= 4.0.0, <= 4.11.4	4.11.5
filament/tables	composer	>= 4.0.0, <= 4.11.4	4.11.5
filament/infolists	composer	>= 5.0.0, <= 5.6.4	5.6.5
filament/tables	composer	>= 5.0.0, <= 5.6.4	5.6.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-3fc8-8hp6-6jr4, is a stored Cross-Site Scripting (XSS) issue within the Filament framework, specifically affecting the ImageColumn and ImageEntry components. The root cause is the failure to escape HTML entities in the src attribute of the <img> tags rendered by these components. The analysis of the security patch commit e1f36a7316d75476f3301e044cc360d7cb746c56 confirms this. The patch applies Laravel's e() helper function to the src attribute's value in both packages/infolists/src/Components/ImageEntry.php and packages/tables/src/Columns/ImageColumn.php. This change ensures that any user-provided data used as an image URL is properly sanitized, preventing malicious scripts from being executed in the user's browser. The vulnerable functions are toEmbeddedHtml in both the ImageEntry and ImageColumn classes, as these are the methods responsible for generating the insecure HTML.

Vulnerable functions

Filament\Infolists\Components\ImageEntry::toEmbeddedHtml

packages/infolists/src/Components/ImageEntry.php

The vulnerability, identified as GHSA-3fc8-8hp6-6jr4, is a stored Cross-Site Scripting (XSS) issue within the Filament framework, specifically affecting the `ImageColumn` and `ImageEntry` components. The root cause is the failure to escape HTML entities in the `src` attribute of the `<img>` tags rendered by these components. The analysis of the security patch commit `e1f36a7316d75476f3301e044cc360d7cb746c56` confirms this. The patch applies Laravel's `e()` helper function to the `src` attribute's value in both `packages/infolists/src/Components/ImageEntry.php` and `packages/tables/src/Columns/ImageColumn.php`. This change ensures that any user-provided data used as an image URL is properly sanitized, preventing malicious scripts from being executed in the user's browser. The vulnerable functions are `toEmbeddedHtml` in both the `ImageEntry` and `ImageColumn` classes, as these are the methods responsible for generating the insecure HTML.

Filament\Tables\Columns\ImageColumn::toEmbeddedHtml

packages/tables/src/Columns/ImageColumn.php

Similar to `ImageEntry`, the `toEmbeddedHtml` function in the `ImageColumn` component was vulnerable to XSS. It directly used a value from the database as the `src` attribute for an `<img>` tag without escaping it. This allowed attackers to inject malicious code (e.g., `javascript:alert(1)`) via the image URL, leading to a stored XSS vulnerability. The fix applies the `e()` escaping function to the `src` attribute's value, preventing the browser from interpreting it as executable code.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.