High severity · published Jun 22, 2026
CVE-2026-55409
Filament: Disabled RichEditor field state can be used for XSS
7.6
CVSS
0.3%
EPSS
No
On KEV
Description
Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML. Where the data stored in this field's state isn't sanitized already when the form state was filled, an attacker could plant malicious HTML or JavaScript and achieve XSS that executes for users who view the form. This vulnerability is fixed in 3.3.53.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
filament · filamentphp
>= 3.0.0, < 3.3.53 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55409
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55409
github.com
https://github.com/filamentphp/filament/security/advisories/GHSA-m9cv-24rx-8mv7
More from filament
8.1
CVE-2026-77567
Filament: App-based MFA can be bypassed when recovery codes are enabled
8.1
CVE-2025-67507
Filament's multi-factor authentication (app) recovery codes can be used multiple times
7.4
CVE-2026-48505
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
6.5
CVE-2026-84306
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
6.5
CVE-2026-48067
Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields