CVE-2026-48500 Filament: Unauthenticated temporary file upload on auth pages
Unauthenticated attackers can upload arbitrary files to temporary storage, potentially exhausting disk space or inflating costs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48500?
CVE-2026-48500 is a medium-severity vulnerability in filamentphp filament, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a file upload form field, so Filament applies Livewire's WithFileUploads trait to the Livewire component the schema is embedded in. However, some schemas, such as the panel login form, do not require file uploads, and exposing unauthenticated temporary file uploads on these components is not an acceptable risk. On these components, an unauthenticated attacker could upload arbitrary files to the application's temporary storage, which could be abused to exhaust disk space or inflate storage costs. This vulnerability is fixed in 3.3.52, 4.11.5, and 5.6.5.
Weakness: CWE-862
Which versions are affected by CVE-2026-48500?
6 open source packages ship an affected version, including filament/filament.
| Package | Affected | Fixed in |
|---|---|---|
filament/filament Packagist | From 3.0.0 | 3.3.52 |
filament/filament Packagist | From 3.0.0 | 3.3.52 |
filament/filament Packagist | From 4.0.0 | 4.11.5 |
filament/filament Packagist | From 4.0.0 | 4.11.5 |
filament/filament Packagist | From 5.0.0 | 5.6.5 |
filament/filament Packagist | From 5.0.0 | 5.6.5 |
How do I fix CVE-2026-48500?
Upgrade filament/filament to a fixed version for your release line: 3.3.52, 4.11.5 or 5.6.5.
Is CVE-2026-48500 being exploited?
There is no known exploitation of CVE-2026-48500 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-44wp-g8f4-f4v5.