Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| filament/filament | composer | >= 4.0.0, <= 4.11.4 | 4.11.5 |
| filament/filament | composer | >= 5.0.0, <= 5.6.4 | 5.6.5 |
| filament/filament | composer | >= 3.0.0, <= 3.3.51 | 3.3.52 |
Miggo AIRoot Cause AnalysisThe vulnerability, GHSA-44wp-g8f4-f4v5, allowed unauthenticated temporary file uploads on authentication pages in Filament. This was due to the unconditional application of Livewire's WithFileUploads trait to Livewire components that handle schemas, including those on authentication pages like the login form where file uploads are not expected.
The WithFileUploads trait exposes the _startUpload and _finishUpload methods, which handle file uploads. On unauthenticated pages, attackers could directly call these methods to upload files to the application's temporary storage, potentially leading to disk space exhaustion or increased storage costs.
The patch addresses this by introducing a new trait, Filament\Schemas\Concerns\RestrictsFileUploadsToSchemaComponents. This trait overrides the _startUpload and _finishUpload methods to include a crucial authorization check. The new implementation verifies that any file upload request corresponds to a legitimate file upload component defined within the page's schema by calling isFileUploadForSchemaComponent(). If the check fails, the request is aborted with a 403 Forbidden status.
This new trait is then applied to all affected authentication-related page components, such as Login, Register, RequestPasswordReset, ResetPassword, EmailVerificationPrompt, and SetUpRequiredMultiFactorAuthentication, effectively closing the security loophole. The vulnerable functions are the original implementations of _startUpload and _finishUpload that lacked this validation.
Filament\Schemas\Concerns\RestrictsFileUploadsToSchemaComponents::_startUploadpackages/schemas/src/Concerns/RestrictsFileUploadsToSchemaComponents.php
Filament\Schemas\Concerns\RestrictsFileUploadsToSchemaComponents::_finishUploadpackages/schemas/src/Concerns/RestrictsFileUploadsToSchemaComponents.php