Medium severity · published Mar 20, 2026
CVE-2026-33080
Filament: Unvalidated Range and Values summarizer values can be used for XSS
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.8.4 and 5.0.0 through 5.3.4 have two Filament Table summarizers (Range, Values) that render raw database values without escaping HTML. If there is a lack of validation for the data in the columns that use these summarizers, an attacker could plant malicious HTML / JavaScript and achieve stored XSS that executes for users who view the table with those summarizers. This issue has been patched in versions 4.8.5 and 5.3.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
filament · filamentphp
>= 4.0.0, < 4.8.5; >= 5.0.0, < 5.3.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33080
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33080
Patch
https://github.com/filamentphp/filament/commit/efa041aeeb4b1a99acd48aaa05584993c926d1ed
Product
https://github.com/filamentphp/filament/releases/tag/v4.8.5
Product
https://github.com/filamentphp/filament/releases/tag/v5.3.5
Vendor Advisory
https://github.com/filamentphp/filament/security/advisories/GHSA-vv3x-j2x5-36jc
More from filament
8.1
CVE-2026-77567
Filament: App-based MFA can be bypassed when recovery codes are enabled
8.1
CVE-2025-67507
Filament's multi-factor authentication (app) recovery codes can be used multiple times
7.6
CVE-2026-55409
Filament: Disabled RichEditor field state can be used for XSS
7.4
CVE-2026-48505
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
6.5
CVE-2026-84306
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
